Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 15:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe
Resource
win7-20240903-en
4 signatures
120 seconds
General
-
Target
0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe
-
Size
25KB
-
MD5
58f36f67134fcac45149c01bacc53ca0
-
SHA1
b973ce2097c356c3a2452ea4ceb006a0ca3d9817
-
SHA256
0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00d
-
SHA512
aba0a933276968e9b2a06ff4fca0b6e98461bbaeddd15e11388b24fffe5301ca2f9b91ad5ed0dc58743e75a2fb87cf1046322c73d4cf102bd9e91d213c0fccfc
-
SSDEEP
768:me3D5dhwrf3Nw1XJqBtYdanwVqyoTcGqwfZJ:me3V3wrf3N87ocdGVZ
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1660-1-0x0000000000020000-0x000000000002E000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2968 1660 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2968 1660 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 29 PID 1660 wrote to memory of 2968 1660 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 29 PID 1660 wrote to memory of 2968 1660 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 29 PID 1660 wrote to memory of 2968 1660 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe"C:\Users\Admin\AppData\Local\Temp\0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 882⤵
- Program crash
PID:2968
-