Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
samsung_expressconnect.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
samsung_expressconnect.exe
Resource
win10v2004-20240802-en
General
-
Target
samsung_expressconnect.exe
-
Size
2.0MB
-
MD5
e06d7b8d5e35fb12211f72cb299dbc2b
-
SHA1
e3faf9509d1b039cbb6169c97f9282a4d98f79da
-
SHA256
6202522ce1935742be316ab319b7e75cbfb6eeb3fb742067cc5923ad6ce8928e
-
SHA512
a1680999f904f896b38f8252f222a9890304c53414ca35b113c9ba1dab297df3201cac33788a79f915391c00352d38c9b912a3efb602f669755ac895cf76b34f
-
SSDEEP
24576:0poAbQKh71pJj6Z05KtOBIQ9QD7QGvvlbtKBMf2RuTQu1FQdIKxQXt/QIies8w7j:+bQKt67oqbBzTMddx+/QresCgF6Ns
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language samsung_expressconnect.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3860 samsung_expressconnect.exe 3860 samsung_expressconnect.exe