Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 17:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Cheats Tools By GotaZ.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cheats Tools By GotaZ.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Cheats Tools By GotaZ.exe
-
Size
197KB
-
MD5
b3616f6b72276fecd8f75f95ef60fd18
-
SHA1
50116dfad40fbdd732258d08c34f29169101999e
-
SHA256
dc5fc3b33df318b385628deff8f41922509a21d5e69d075c4a2311a8c2d82658
-
SHA512
ba83ab6148ac3a92b35ea83d3d3d2ee72d434e93c3654e89b1ae19bda5b7c45586b7041c76f5a08c82d5ab4529ede0c1be091ee6d839ec39a44696b9c49dd558
-
SSDEEP
3072:avSiI8XnEGarrpFtGarrps0XDFKgRvMe7Garrs:iI8XEFFfFFs0zVn7F
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cheats Tools By GotaZ.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3468 Cheats Tools By GotaZ.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3468 Cheats Tools By GotaZ.exe