Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 03:33
Behavioral task
behavioral1
Sample
3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe
Resource
win7-20240903-en
General
-
Target
3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe
-
Size
10.3MB
-
MD5
50fbdcd4027ed3c8c8b342bb4a2317e6
-
SHA1
c5e0e2dd10802831acffc8d1dc48057af85f810b
-
SHA256
3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee
-
SHA512
003f71eddbd4482d445d1f50eddf0162ef9c324777d71c4dc5d2c241e56ce930cec1d81c8e43c26092c597055987d3d025330a501429f8a52ac0921a9f321e9c
-
SSDEEP
196608:AADRDH5DD3DQZ72NPO8R3BVXgh2+1uaaYiYzWotD0/NBnk4o1pDaPAvDDYWiXTt:3DRVsZmTfgJKYnd0/NtsQUYRXB
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3132-8-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-11-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-14-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-15-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-16-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-17-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-18-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-19-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-20-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-21-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-22-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-23-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-24-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect behavioral2/memory/3132-25-0x0000000000400000-0x0000000001540000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe -
resource yara_rule behavioral2/memory/3132-13-0x0000000003690000-0x00000000036B6000-memory.dmp upx behavioral2/memory/3132-12-0x0000000003660000-0x0000000003686000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3132 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe 3132 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe 3132 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe 3132 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3132 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe 3132 3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe"C:\Users\Admin\AppData\Local\Temp\3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3132