Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
14/11/2024, 07:23 UTC
General
-
Target
17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe
-
Size
469KB
-
MD5
0264973bb3393bdf7491f187453125b9
-
SHA1
1dc322f633b7bf9f53efccdacd160edde8eb788b
-
SHA256
16633659b34e72eca765b68ad3119bf4505360863458667d7e93cbfdd2c08ce2
-
SHA512
d47d5223a529d6fd269d00c22f3da95223f3fb7c93b6967e9236735780ac5cbe3c188ba45d9f229275d330857c47f0a9c77409d3ab62c97e2955fe641bffb66b
-
SSDEEP
12288:Omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSiCn9:2iLJbpI7I2WhQqZ7iC9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
-
DNSalpha147.ddns.netRemote address:8.8.8.8:53Requestalpha147.ddns.netIN AResponsealpha147.ddns.netIN A154.216.18.186 -
DNSgeoplugin.netRemote address:8.8.8.8:53Requestgeoplugin.netIN AResponsegeoplugin.netIN A178.237.33.50
-
GEThttp://geoplugin.net/json.gpRemote address:178.237.33.50:80RequestGET /json.gp HTTP/1.1
Host: geoplugin.net
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
date: Thu, 14 Nov 2024 07:23:11 GMT
server: Apache
content-length: 956
content-type: application/json; charset=utf-8
cache-control: public, max-age=300
access-control-allow-origin: *
-
154.216.18.186:35890alpha147.ddns.nettls
-
178.237.33.50:80http://geoplugin.net/json.gphttp
HTTP Request
GET http://geoplugin.net/json.gpHTTP Response
200
-
8.8.8.8:53alpha147.ddns.netdns
DNS Request
alpha147.ddns.net
DNS Response
154.216.18.186
-
8.8.8.8:53geoplugin.netdns
DNS Request
geoplugin.net
DNS Response
178.237.33.50
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD59d946a3bf09ca40a9ec6877ca349ef66
SHA13339d2a6defda3c9590e6c010cdcf5d68d11f648
SHA256077e54ec35a70d64c51cd9fad35a1a0f64f39770e4d00a72e158ebb5e7a5a3e0
SHA51242ac86092afc4ac64f2d6ae99843faa5b712a7fbddc5182b621153c2fd8fd679f57257de48f71fdfa0536d04da7cfb440a4e99afcd9a93b75f358aa759a5284e