Analysis

  • max time kernel
    140s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-11-2024 03:58

General

  • Target

    New folder (4)/free robbux/RouterPassView.exe

  • Size

    71KB

  • MD5

    e8e5092e66437517f5940e1498075ccb

  • SHA1

    92518cd8f52fc30e852f3b51450f9288b2f36b70

  • SHA256

    cee7a91f25d2bed0ba442b25bc5a4c516c61d4bacb3c096dfdbda29efb99a140

  • SHA512

    af5244603718e211f851b92a71f4fa794475a76bce2c4d10fe58dc2de0f6af03adde64e2e3a25918297f51fadba10a9533fb31cfeef0361b31ae93b891abcaca

  • SSDEEP

    1536:Gw0y1nAzKcbvLx+qLxxugU3GI71x5wVtsUtvc4R3Z0qehOx:GwDNTc/04NG7hx5wVuiBR3Z0qX

Score
9/10

Malware Config

Signatures

  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\New folder (4)\free robbux\RouterPassView.exe
    "C:\Users\Admin\AppData\Local\Temp\New folder (4)\free robbux\RouterPassView.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4628-0-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4628-1-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB