Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29-09-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe
Resource
win10v2004-20240802-en
General
-
Target
5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe
-
Size
1.1MB
-
MD5
f7c6985fc26ca3e3121786509a92c6a0
-
SHA1
cfc37190cdcc1367fb52c39295466d640773aa10
-
SHA256
5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80b
-
SHA512
a3ba6b96f98c579701252658c400310defaa6dd633945389c100e0be3b62b01f62d844d600109c6a562f7bdcb006d6ac9ea2489f8297c201a22eec7ca0db68d2
-
SSDEEP
24576:zjmOztIjpVbUJ44R/DDK2s5mNZRzOUCrA/N3rF:zqAtI704g/D3Tm03R
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2604 set thread context of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1760 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 1760 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 1760 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 1760 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 1760 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30 PID 2604 wrote to memory of 1760 2604 5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe"C:\Users\Admin\AppData\Local\Temp\5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5e04edbf522736ed30101d5f12744c8e8582e3a006425fb4550ad8a7d459a80bN.exe
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1760
-