Overview
overview
10Static
static
7a6e9684002...c0.exe
windows7-x64
10a6e9684002...c0.exe
windows10-2004-x64
10$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$_39_/PowerRun64.exe
windows7-x64
4$_39_/PowerRun64.exe
windows10-2004-x64
3$_39_/SetACL64.exe
windows7-x64
1$_39_/SetACL64.exe
windows10-2004-x64
1$_39_/bn.bat
windows7-x64
1$_39_/bn.bat
windows10-2004-x64
1$_39_/bn1.bat
windows7-x64
10$_39_/bn1.bat
windows10-2004-x64
10$_39_/bnn.bat
windows7-x64
1$_39_/bnn.bat
windows10-2004-x64
1$_39_/bnz.bat
windows7-x64
1$_39_/bnz.bat
windows10-2004-x64
1$_39_/dotN...up.exe
windows7-x64
7$_39_/dotN...up.exe
windows10-2004-x64
7$_39_/dotN...up.exe
windows7-x64
7$_39_/dotN...up.exe
windows10-2004-x64
7$_39_/tbjf...du.exe
windows7-x64
3$_39_/tbjf...du.exe
windows10-2004-x64
3$_39_/win_...rp.exe
windows7-x64
3$_39_/win_...rp.exe
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 02:38
Behavioral task
behavioral1
Sample
a6e96840029b64d72ddfd94ede969f521e1c05b91d5c23eee56b66afae6800c0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a6e96840029b64d72ddfd94ede969f521e1c05b91d5c23eee56b66afae6800c0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$_39_/PowerRun64.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
$_39_/PowerRun64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$_39_/SetACL64.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$_39_/SetACL64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$_39_/bn.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$_39_/bn.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$_39_/bn1.bat
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
$_39_/bn1.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$_39_/bnn.bat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$_39_/bnn.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$_39_/bnz.bat
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
$_39_/bnz.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$_39_/dotNetFx40_Full_setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$_39_/dotNetFx40_Full_setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$_39_/dotNetFx45_Full_setup.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
$_39_/dotNetFx45_Full_setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$_39_/tbjfarxhkycdu.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
$_39_/tbjfarxhkycdu.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$_39_/win_version_csharp.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$_39_/win_version_csharp.exe
Resource
win10v2004-20241007-en
General
-
Target
$_39_/win_version_csharp.exe
-
Size
6KB
-
MD5
7cb364701028767f8942cc3f8439f8f2
-
SHA1
d6bede2206b7042b4cae32f416e1b43ffac94238
-
SHA256
a2716605f8dd1930808e6918db670a3fe32287791862883dbabd26849b87b09e
-
SHA512
3011b3d64f79280ab05de9658c4f5a13f637ad2e79d5770cfaeb3af6cb8c7a56b610dad69fdf295112be64cfb80e18f30bb1829eb3c0e549105f63d0e770dc13
-
SSDEEP
96:/uidPNKO2mkcQ7DBOrkB0kPkKXwF4dkd8Nue3qYMns1BjgtRQWWzNt:FIOu7DBOrkB0kPkKXwF4dkd8Nn34nUBR
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_version_csharp.exe