Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b.exe
Resource
win10v2004-20241007-en
General
-
Target
77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b.exe
-
Size
3.4MB
-
MD5
e371a0b16513973dbae11324982c94ba
-
SHA1
63aa52989ff597e461c6bf800987edd2c424a205
-
SHA256
77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b
-
SHA512
edf9f0368ae73418d8e5e7ca741a4525be1f0bd008115378dfb4ce174f8c4df6fbedcfd43b3ddb63370ad768359614b5e96820db5a233a73c12165d86ff8a068
-
SSDEEP
49152:sbjx7ZaXzZN4bHW6gKMnMU9h4BvVmLKtHIrLiffn2qdlh9HXKYJlw44NKn3qqcNh:qxINw2VKMBQbwev2qdlhvq49nfY5iQv
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1248 77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b.exe 1248 77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b.exe"C:\Users\Admin\AppData\Local\Temp\77e7cbe11693a0fe30df9735289da93eb7d7ebf5b9e53a797019cc73c599887b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1248