Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 21:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe
Resource
win7-20240903-en
3 signatures
150 seconds
General
-
Target
087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe
-
Size
1.1MB
-
MD5
a36f7dd9391960fc3984f38a916a5ee3
-
SHA1
1a9266cc906ae29183cb4a88a73481752593d495
-
SHA256
087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24
-
SHA512
19035cd0344427bf206915b05e903b6705a13be883e4af85bd42bfefccb6fe0db0d65aa5371e501f3cf8c90bb8dc995df04036999987bddf75e1a231f679db8b
-
SSDEEP
24576:yewP0KoXAy34gV2+qRSxkDHfJD3cPqsl3bR1:yPPDoXAyt2rHfZcispX
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1504-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1504-49-0x0000000010000000-0x000000001003E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1504 087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe 1504 087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe 1504 087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe"C:\Users\Admin\AppData\Local\Temp\087033364a9ac5b1c1ceb3bbd091be90d26a54bcacda48354914d13a8a17db24.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1504