Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:47 UTC

General

  • Target

    118eaa0d54a0b2b63c2cf46557e71548cf6748741647e66bb126fb3fb01e9c27.exe

  • Size

    89KB

  • MD5

    0abc80ac3ed60ede55ab8bf1a9e7df07

  • SHA1

    4baf9c7f3e3bf1891875eb40438401c53ff5edc7

  • SHA256

    118eaa0d54a0b2b63c2cf46557e71548cf6748741647e66bb126fb3fb01e9c27

  • SHA512

    f8689408b21c42e0857ace917e00c4f3ba7f79d18b104889412bdc1b2e6c781048a7167a37f008690b05413216f1cec1fbebfb1aa4f6cdfced1384c6432bf0d6

  • SSDEEP

    1536:l9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:l9o6fK2XqXQwhnHlqQo8Lvy

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2776
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\118eaa0d54a0b2b63c2cf46557e71548cf6748741647e66bb126fb3fb01e9c27.exe
        "C:\Users\Admin\AppData\Local\Temp\118eaa0d54a0b2b63c2cf46557e71548cf6748741647e66bb126fb3fb01e9c27.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1776
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 640
            4⤵
            • Program crash
            PID:4396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2276 -ip 2276
      1⤵
        PID:5112

      Network

      • flag-us
        DNS
        149.220.183.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        149.220.183.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        www.google.com
        winver.exe
        Remote address:
        8.8.8.8:53
        Request
        www.google.com
        IN A
        Response
        www.google.com
        IN A
        142.250.180.4
      • flag-us
        DNS
        insamertojertoq.cc
        winver.exe
        Remote address:
        8.8.8.8:53
        Request
        insamertojertoq.cc
        IN A
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        138.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        138.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        28.118.140.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        28.118.140.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        53.210.109.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        53.210.109.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.42.69.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.42.69.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        106.209.201.84.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        106.209.201.84.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        21.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        21.236.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        149.220.183.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        149.220.183.52.in-addr.arpa

      • 8.8.8.8:53
        www.google.com
        dns
        winver.exe
        60 B
        76 B
        1
        1

        DNS Request

        www.google.com

        DNS Response

        142.250.180.4

      • 8.8.8.8:53
        insamertojertoq.cc
        dns
        winver.exe
        64 B
        131 B
        1
        1

        DNS Request

        insamertojertoq.cc

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        138.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        138.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        28.118.140.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        28.118.140.52.in-addr.arpa

      • 8.8.8.8:53
        53.210.109.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        53.210.109.20.in-addr.arpa

      • 8.8.8.8:53
        241.42.69.40.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        241.42.69.40.in-addr.arpa

      • 8.8.8.8:53
        106.209.201.84.in-addr.arpa
        dns
        73 B
        133 B
        1
        1

        DNS Request

        106.209.201.84.in-addr.arpa

      • 8.8.8.8:53
        21.236.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        21.236.111.52.in-addr.arpa

      • 8.8.8.8:53

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1776-11-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/1776-14-0x00000000024A0000-0x0000000002EA0000-memory.dmp

        Filesize

        10.0MB

      • memory/1776-0-0x0000000000500000-0x0000000000502000-memory.dmp

        Filesize

        8KB

      • memory/1776-5-0x00000000024A0000-0x0000000002EA0000-memory.dmp

        Filesize

        10.0MB

      • memory/2276-15-0x0000000000D10000-0x0000000000D16000-memory.dmp

        Filesize

        24KB

      • memory/2276-2-0x0000000000D10000-0x0000000000D16000-memory.dmp

        Filesize

        24KB

      • memory/2276-7-0x0000000077DA2000-0x0000000077DA3000-memory.dmp

        Filesize

        4KB

      • memory/2276-6-0x0000000000D10000-0x0000000000D16000-memory.dmp

        Filesize

        24KB

      • memory/2276-9-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

        Filesize

        2.0MB

      • memory/2776-13-0x00000000003B0000-0x00000000003B6000-memory.dmp

        Filesize

        24KB

      • memory/2776-12-0x00000000003B0000-0x00000000003B6000-memory.dmp

        Filesize

        24KB

      • memory/2776-17-0x00007FF93B490000-0x00007FF93B491000-memory.dmp

        Filesize

        4KB

      • memory/3420-10-0x00007FF93B4A0000-0x00007FF93B4A1000-memory.dmp

        Filesize

        4KB

      • memory/3420-8-0x00007FF93B30D000-0x00007FF93B30E000-memory.dmp

        Filesize

        4KB

      • memory/3420-1-0x00000000030F0000-0x00000000030F6000-memory.dmp

        Filesize

        24KB

      • memory/3420-4-0x00000000030F0000-0x00000000030F6000-memory.dmp

        Filesize

        24KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.