Analysis

  • max time kernel
    93s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 23:52

General

  • Target

    Rack/47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe

  • Size

    777KB

  • MD5

    5b712f99b32783231704adc73a251e46

  • SHA1

    cf0589c32b4d18303e194672a7710fd6a9a655d6

  • SHA256

    47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f

  • SHA512

    b3d45c54a9280534ea6471f252635f5cc04cb8a95f70d87041af24033f21db332184eaba72149c29b1028ba8d84fdfe0b54c46dd91952ca930bebb2a297c22dd

  • SSDEEP

    12288:nZ+pDu9YrDQKiXEfiVzhY1Iys0P9ckXgeteabKSctHSoHJD4XWdFvn:n80sDNiUfiPgI91kXgeYEF2HSoHYCFf

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rack\47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe
    "C:\Users\Admin\AppData\Local\Temp\Rack\47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1220
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 392
      2⤵
      • Program crash
      PID:1632
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1220 -ip 1220
    1⤵
      PID:4852

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1220-0-0x00000000009D0000-0x0000000000A99000-memory.dmp

      Filesize

      804KB