bbfdb2bedf8b86153f608996a3f1bc41b5cf569d4393015dea8f015b4f32ec6f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.9/Obf/Stresser.exe
Size

421KB
MD5

64357c0d06ac60c54f397037183fd256
SHA1

40197bbc88dacfbf19183c3c9f37987c0976c157
SHA256

1687e6a1511dc68a5e065fbc7c5edb500150cae01dc0fa2b271b236908f4323d
SHA512

3816c35be3163e84051f70a67506f0d21ef6262662d69e158738279f9716c6aaed458a83a6a3136253867773e78f1f2a547b71755c4406454d4068a85f1135b7
SSDEEP

6144:gnYKsxwZQ8earsh5Q+64EWBdWV3vBLGPUbbRXxt5XxtdAdq:PM+Q+6tWTWBvBUitPtiE

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	1884	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stresser.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 804	1884	Stresser.exe	30
PID 1884 wrote to memory of 804	1884	Stresser.exe	30
PID 1884 wrote to memory of 804	1884	Stresser.exe	30
PID 1884 wrote to memory of 804	1884	Stresser.exe	30

C:\Users\Admin\AppData\Local\Temp\1.9\Obf\Stresser.exe
"C:\Users\Admin\AppData\Local\Temp\1.9\Obf\Stresser.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 536
  2⤵
  - Program crash
  PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-0-0x000000007492E000-0x000000007492F000-memory.dmp

Filesize
4KB

Download
memory/1884-1-0x0000000000BE0000-0x0000000000C52000-memory.dmp

Filesize
456KB

Download