Resubmissions
19-10-2024 11:46
241019-nxh3lawepj 1019-10-2024 11:42
241019-nvc4kathmg 719-10-2024 11:38
241019-nrspvawcnp 1019-10-2024 11:33
241019-nnzc8atfla 1019-10-2024 11:27
241019-nkpplswakl 1019-10-2024 11:23
241019-nhfnxsvhmk 1019-10-2024 11:11
241019-najevashqf 1019-10-2024 11:07
241019-m762qssgph 3Analysis
-
max time kernel
92s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-10-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
6812964531.exe
Resource
win11-20241007-en
General
-
Target
6812964531.exe
-
Size
67KB
-
MD5
7de65122a13ab9d81368ee3dff3cc80a
-
SHA1
ecbb4db641431d4d672e4b88e8d309419fd32f04
-
SHA256
a73a05a4b6ec6ae1c1ba6d3d12b68cc52b899e2a6dbbaaa1f48f2c260a733123
-
SHA512
b156d77a665c3256ddfd016e46105b6e87db6a4c1ca77e9bb25b221c368f3cc53dddc7159602cfb926ef0cc9bacac57b6bd41e7e28998883c996727d58d29401
-
SSDEEP
1536:pr3rob4nqB6veqHnq+Pgm5NN9vbDTc+1vIQ/EXyBej:h7PEg3qcv5PvB/EVj
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6812964531.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5364 wrote to memory of 4956 5364 6812964531.exe 77 PID 5364 wrote to memory of 4956 5364 6812964531.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\6812964531.exe"C:\Users\Admin\AppData\Local\Temp\6812964531.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\6812964531.exe"2⤵PID:4956
-