Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:02
Behavioral task
behavioral1
Sample
fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe
Resource
win10v2004-20241007-en
General
-
Target
fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe
-
Size
164KB
-
MD5
deef7458a20a39b4d8b20f329ef62acc
-
SHA1
db5bdf0d8dcccb2904af515cddcfb5a9acb91e67
-
SHA256
fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d
-
SHA512
f903e9f537cbc7a1ba6eac7a8be1d2d886deff3f181765728bf98e9ba5c3735c18bf2d279aad75186a893ed0a971e540a04d97300aecc6fb6140cc776dd2c694
-
SSDEEP
3072:vgJyWjZD8CJZweUAPM8rUeL3x9/tE591VPNSPkDyx0kRQTxlR:v9EJTM8oYB9/tE593lSrxtOTN
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1880 fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe 1880 fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe"C:\Users\Admin\AppData\Local\Temp\fc36a75526af9f066a8df6de18e7f059a8c2ac5d32313c1465ab3037e6eadb1d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1880