Analysis
- max time kernel
140s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 22:15
Behavioral task
behavioral1
Sample
512235b83e858a2b11b7bcfaa93516c2a614b2360dfdf3605129ea819e007117.exe
Resource
win7-20240903-en
2 signatures
150 seconds
General
- Target 512235b83e858a2b11b7bcfaa93516c2a614b2360dfdf3605129ea819e007117.exe
- Size 83KB
- Sample241109-158z7stdkf
- SHA256 512235b83e858a2b11b7bcfaa93516c2a614b2360dfdf3605129ea819e007117
- MD5 902f3100977c4653c174c0ece4882703
- SHA1 22abe2d8d8814c22d382152bdc25c2f8f4ab590d
- SHA512 8c11713fe77a56a3f6f219c13c6dbc323edaf163ba628032662f7575bf927648099a8519dd0166d9a8caf0bcc36a91f1e28bd4fd6523635f3d0da42f932113ef
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+3K:LJ0TAz6Mte4A+aaZx8EnCGVu3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/900-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0008000000023cc6-12.dat upx behavioral2/memory/900-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-29-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512235b83e858a2b11b7bcfaa93516c2a614b2360dfdf3605129ea819e007117.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rifaien2-dIsZcPag4levzqZJ.exe
- Size 83KB
- SHA256 233c63dece9b4330e0de2cf339a7607a0db200b6a9096cb7db86d46ff1145ee0
- MD5 e14b2f8959f4853582f1fa1a1fda21ef
- SHA1 b4264f56c7ff3498fe7daaadb45b73915afe4be8
- SHA512 dc49c92bde122f66893989ae077e064d448396ab5ce08352a4562d49738fcb3b7aca5923afcf1cdc277a4ac512f91202fc3ef251351f2ff7bfaf041fa2a77da9
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux
- MD5 SHA1 SHA512 SSDEEP