Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 16:14

General

  • Target

    samsung_expressconnect.exe

  • Size

    2.0MB

  • MD5

    e06d7b8d5e35fb12211f72cb299dbc2b

  • SHA1

    e3faf9509d1b039cbb6169c97f9282a4d98f79da

  • SHA256

    6202522ce1935742be316ab319b7e75cbfb6eeb3fb742067cc5923ad6ce8928e

  • SHA512

    a1680999f904f896b38f8252f222a9890304c53414ca35b113c9ba1dab297df3201cac33788a79f915391c00352d38c9b912a3efb602f669755ac895cf76b34f

  • SSDEEP

    24576:0poAbQKh71pJj6Z05KtOBIQ9QD7QGvvlbtKBMf2RuTQu1FQdIKxQXt/QIies8w7j:+bQKt67oqbBzTMddx+/QresCgF6Ns

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\samsung_expressconnect.exe
    "C:\Users\Admin\AppData\Local\Temp\samsung_expressconnect.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3860-0-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/3860-2-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/3860-1-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-3-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-4-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-5-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-6-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-7-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-8-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-9-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-10-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-11-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-12-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-13-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-14-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB

  • memory/3860-15-0x0000000000400000-0x0000000000694000-memory.dmp

    Filesize

    2.6MB