Analysis
- max time kernel
140s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 23:28
Behavioral task
behavioral1
Sample
744ae49a95157d51913d5f6de448f9d07ef3d3154866f911ca4f96a27322a65a.exe
Resource
win7-20240903-en
2 signatures
150 seconds
General
- Target 744ae49a95157d51913d5f6de448f9d07ef3d3154866f911ca4f96a27322a65a.exe
- Size 83KB
- Sample241109-3f196stmbx
- SHA256 744ae49a95157d51913d5f6de448f9d07ef3d3154866f911ca4f96a27322a65a
- MD5 ccd969e2f30b7a8b47ab974fcdd316d1
- SHA1 5985e4fbdab5a46172dceab1667b3d50a3e07a5f
- SHA512 ec61b72164df9e46b100b9783ee28a729920994e70cfa9ba1a3a5e53c219336496f999a1f2bf3aec52178df34f4815e9832287c1570b32b4a8c57c6a74f2eacd
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:LJ0TAz6Mte4A+aaZx8EnCGVuW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4712-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0002000000021f9c-11.dat upx behavioral2/memory/4712-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-29-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 744ae49a95157d51913d5f6de448f9d07ef3d3154866f911ca4f96a27322a65a.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rifaien2-VVTZaRp0qEU1eNN7.exe
- Size 83KB
- SHA256 fb63a25421ee337d294b9dc098f9f8a21a87e9acab62c9620cb445f791125f7e
- MD5 f7adb63434be00bdfba63f5eca243213
- SHA1 608a0cacab84043f8ceaf91830dff729472bf035
- SHA512 96198320aa091b8fd1d3560fea8d1a53e3bf2e7a6ac728a1de06527c203b855aa8e98e7f504315cd5fea81e4222f0e40819c46ff44cbf52a5310fcd9a95ed397
- SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux
- MD5 SHA1 SHA512 SSDEEP