bbfdb2bedf8b86153f608996a3f1bc41b5cf569d4393015dea8f015b4f32ec6f

Analysis

max time kernel
138s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.9/Obf/Stresser.exe
Size

421KB
MD5

64357c0d06ac60c54f397037183fd256
SHA1

40197bbc88dacfbf19183c3c9f37987c0976c157
SHA256

1687e6a1511dc68a5e065fbc7c5edb500150cae01dc0fa2b271b236908f4323d
SHA512

3816c35be3163e84051f70a67506f0d21ef6262662d69e158738279f9716c6aaed458a83a6a3136253867773e78f1f2a547b71755c4406454d4068a85f1135b7
SSDEEP

6144:gnYKsxwZQ8earsh5Q+64EWBdWV3vBLGPUbbRXxt5XxtdAdq:PM+Q+6tWTWBvBUitPtiE

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5008 4216 WerFault.exe Stresser.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Stresser.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Stresser.exe

pid	pid_target	process	target process
5008	4216	WerFault.exe	Stresser.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stresser.exe

C:\Users\Admin\AppData\Local\Temp\1.9\Obf\Stresser.exe
"C:\Users\Admin\AppData\Local\Temp\1.9\Obf\Stresser.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 804
  2⤵
  - Program crash
  PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4216 -ip 4216
1⤵
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4216-0-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

Filesize
4KB

Download
memory/4216-1-0x0000000000B20000-0x0000000000B92000-memory.dmp

Filesize
456KB

Download