Analysis
- max time kernel
111s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 21:34
Behavioral task
behavioral1
Sample
dcee5dc086b6467b7fd4d5dfbcda1a5dc9260128bc2229279b82eccea280d032N.exe
Resource
win7-20241010-en
2 signatures
120 seconds
General
- Target dcee5dc086b6467b7fd4d5dfbcda1a5dc9260128bc2229279b82eccea280d032N.exe
- Size 83KB
- Sample241109-1e4b2asgkh
- SHA256 dcee5dc086b6467b7fd4d5dfbcda1a5dc9260128bc2229279b82eccea280d032
- MD5 d814d5444709e887159903482dd5a7c0
- SHA1 c54d6bd782eea611cff87c40161d629d831f3d9a
- SHA512 dd0c6931909314bf8409b4f5a001201b1d128aa05243c1a40f5209827f37f7973c1b8e1dcfbbc8acc5d1cadd91034c4df385f9bd9412b4307b4a19831cbf8b28
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3796-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0008000000023c79-12.dat upx behavioral2/memory/3796-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-22-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcee5dc086b6467b7fd4d5dfbcda1a5dc9260128bc2229279b82eccea280d032N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rifaien2-2Pg7wGLXMRBhqmVp.exe
- Size 83KB
- SHA256 68d54e5f93746e925fd94afef1c8b119b53b6598bc4f82391af96d3dfe0e1cb9
- MD5 be2511a8da88db34965fd9636dfe4be4
- SHA1 b6436494acdefdfc4e242ff0940fcc65df1af59e
- SHA512 2635a73d687879c166ca7ff41516c21bb1c3a927bacc96b6d296505b27f3f9870ee1ed801469dd4d243ce0ee0c2c9a2537650f57c9f8558299d0b6c8ae354a80
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue
- MD5 SHA1 SHA512 SSDEEP