Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe
Resource
win10v2004-20241007-en
General
-
Target
2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe
-
Size
442KB
-
MD5
3e57435a03ae3188b17f34183b126ec0
-
SHA1
0c0a54ca7e7e7c5125532a9b10076e6d0295bab1
-
SHA256
2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1
-
SHA512
a7120c60debe61d8d4b5343d474a29b0eb444f79e00fc60ada24ca4e0cb6f446d1325eaf67808c44628c7c8e05fb68a28c89c4f2d1555f0bdb08bb8c6e0a4710
-
SSDEEP
6144:Mr9EkvFT8eK55duZtOSYythAjTbsgbKXAU4IYGD35JIqIIItTHQLo16S0RDpCtp/:+E08b5dLSoj8sKhiQo6bu0R1CtfquSo
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1768 2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe 1768 2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe 1768 2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\GLBSINST.%$D 2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe"C:\Users\Admin\AppData\Local\Temp\2ef8cbfe593b292b8932d5906398a8d6f7d15f53562eb12349d411991d3c33f1N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150KB
MD5f3b9bfed127ffc97f63cd8c7ce8bc1a9
SHA1468425842e3a29a4de6adb03652f02fdafd9fc82
SHA2569acc324586a37cfa6f862439cfea45acd1378b4880b831cf5cca71389e0c5582
SHA512671828ffce8660e3326f63f4e6a80941bbacfaa13ded2d58e6ffeacf9501ee66683b70fa4a100bfe7d24aea6fee8c3eda0e9a6c5ecdd792f6febb1981be030ff
-
Filesize
44KB
MD503a537a2be784dbb334a559347587a8d
SHA12bc6ac78a7928468584b38c49fc8191cdf7cd7b8
SHA256791cbaf92b019d23967483cf97ae1b261754ba1d18ada81d01c50f4dc1e97ac5
SHA512527eb7bd1ba88dd5c59c65e65a4485cf5524c64c011afad17c81faacab9b9aed32fc25da8fb54582ff828f788e43303b846fb236a3b97f8c29a977b23c154037