Overview

overview

10

Static

static

10

14100f8848...d8.exe

windows7-x64

3

14100f8848...d8.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 01:13 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe

  • Size

    32KB

  • MD5

    6d6cd3ac8ae40d126b8f827cd870ee5c

  • SHA1

    63045ebfe0a7eb38105eefbe051e9a85b7e264f7

  • SHA256

    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8

  • SHA512

    20a77793ee5dcef0a3f6fd15326045cf56bab1bc17ef9422b12b6b1803e8eaad226aa7b2d40c9db8b0d670d55806f0176a8b39feb55328f78dbbced309bd071f

  • SSDEEP

    384:e0bUe5XB4e0XGOt8w0Q0mS03AWTxtTUFQqzFaqObbp:PT9BuVH55dNbp

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    "C:\Users\Admin\AppData\Local\Temp\14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2332

Network

  • flag-us
    DNS
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    Remote address:
    8.8.8.8:53
    Request
    michael2009nj.duckdns.org
    IN A
    Response
    michael2009nj.duckdns.org
    IN A
    186.169.89.218
  • flag-us
    DNS
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    Remote address:
    8.8.8.8:53
    Request
    michael2009nj.duckdns.org
    IN A
    Response
    michael2009nj.duckdns.org
    IN A
    186.169.89.218
  • flag-us
    DNS
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    Remote address:
    8.8.8.8:53
    Request
    michael2009nj.duckdns.org
    IN A
    Response
    michael2009nj.duckdns.org
    IN A
    186.169.89.218
  • 186.169.89.218:2828
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    152 B
     3
  • 186.169.89.218:2828
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    152 B
     3
  • 186.169.89.218:2828
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    152 B
     3
  • 186.169.89.218:2828
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    152 B
     3
  • 186.169.89.218:2828
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    152 B
     3
  • 186.169.89.218:2828
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    152 B
     3
  • 186.169.89.218:2828
    michael2009nj.duckdns.org
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    104 B
     2
  • 8.8.8.8:53
    michael2009nj.duckdns.org
    dns
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    71 B
     87 B
     1
    1

    DNS Request

    michael2009nj.duckdns.org

    DNS Response

    186.169.89.218

  • 8.8.8.8:53
    michael2009nj.duckdns.org
    dns
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    71 B
     87 B
     1
    1

    DNS Request

    michael2009nj.duckdns.org

    DNS Response

    186.169.89.218

  • 8.8.8.8:53
    michael2009nj.duckdns.org
    dns
    14100f8848c185ca08a4024c6da12a490a4034989d7f05814b65bc60b95bb5d8.exe
    71 B
     87 B
     1
    1

    DNS Request

    michael2009nj.duckdns.org

    DNS Response

    186.169.89.218

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2332-0-0x0000000074BB1000-0x0000000074BB2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-1-0x0000000074BB0000-0x000000007515B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2332-2-0x0000000074BB0000-0x000000007515B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2332-3-0x0000000074BB0000-0x000000007515B000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.