Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2024 14:01
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
1.2MB
-
MD5
30e7792e97b603a992240e27bade2a36
-
SHA1
d4e2d09ae91c8d295e1d2b78ec0daafbe43322e1
-
SHA256
c94f21254373c228e200a85422f611768978e785385d2802883cb1b75a0b31b0
-
SHA512
f786b9139afd18342e8adb2e182fc75b021f38b44e80ef612ea62b83c1074d6772c7510bdfc6e19343d1bbff0bf5ed525ae2d4270baad3af14954c1066ef5e6c
-
SSDEEP
24576:87rIexTF/+W9FyWiZmN+InMO6JHZT4tapQgUTKO8YWAUc:ApX9FyWiZmQPO6J5VRZkWAU
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 1748 set thread context of 2604 1748 file.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2044 2604 WerFault.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
file.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
file.exedescription pid process target process PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe PID 1748 wrote to memory of 2604 1748 file.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 5683⤵
- Program crash
PID:2044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2604 -ip 26041⤵PID:3544