Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 21:34
Behavioral task
behavioral1
Sample
40018dd0f40ada2839abafef162ec1c8e60d889aa8149a88faf678d0370360dc.exe
Resource
win7-20240903-en
2 signatures
150 seconds
General
- Target 40018dd0f40ada2839abafef162ec1c8e60d889aa8149a88faf678d0370360dc.exe
- Size 83KB
- Sample241109-1evd5a1rh1
- SHA256 40018dd0f40ada2839abafef162ec1c8e60d889aa8149a88faf678d0370360dc
- MD5 c296d1dd13c2d86f501d0bb7700f5b80
- SHA1 d773178b09091338bfa5f68eb03a2e34e040cefc
- SHA512 7936fe3b11ce22da0ce96d57b7f33352523eab28a789b86f66a0bb8c20ed74230f15164501e0fbe58310a955e3ab5792c6829bec5e8fe296812fea4cafc630a4
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+0K:LJ0TAz6Mte4A+aaZx8EnCGVu0
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1996-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0009000000023c04-12.dat upx behavioral2/memory/1996-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-29-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40018dd0f40ada2839abafef162ec1c8e60d889aa8149a88faf678d0370360dc.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rifaien2-g1Lyd1JQbMde5tCl.exe
- Size 83KB
- SHA256 bff3c75a551d629550472bb662fbbd186c84bd880510413c6d91fee9ccbf859e
- MD5 79a4922c379b37681858ee7d41efc861
- SHA1 6078332a61404a0f433dd762c5b5467dd8409ad3
- SHA512 8eee4ec146c40a5d1ee800ccdde02e07fb6356c3b299d32fa17ad31ba016052969f326fa87b60e59cd07f31dcd7691b3b1fc5d864e5878f21f150d98e53f5491
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
- MD5 SHA1 SHA512 SSDEEP