Overview

overview

10

Static

static

10

malware/EinTT.exe

windows7-x64

10

malware/EinTT.exe

windows10-2004-x64

10

malware/fox.exe

windows7-x64

3

malware/fox.exe

windows10-2004-x64

3

malware/guJPO.exe

windows7-x64

10

malware/guJPO.exe

windows10-2004-x64

10

malware/loader1.exe

windows7-x64

10

malware/loader1.exe

windows10-2004-x64

7

dnjdbaa.exe

windows7-x64

3

dnjdbaa.exe

windows10-2004-x64

3

malware/regasm.exe

windows7-x64

10

malware/regasm.exe

windows10-2004-x64

10

malware/vbc.exe

windows7-x64

10

malware/vbc.exe

windows10-2004-x64

7

rywcikv.exe

windows7-x64

3

rywcikv.exe

windows10-2004-x64

3

malware/vbc1.exe

windows7-x64

10

malware/vbc1.exe

windows10-2004-x64

7

eblupydfzx.exe

windows7-x64

3

eblupydfzx.exe

windows10-2004-x64

3

malware/vbc2.exe

windows7-x64

10

malware/vbc2.exe

windows10-2004-x64

7

ioatgumevw.exe

windows7-x64

3

ioatgumevw.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 20:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    rywcikv.exe

  • Size

    4KB

  • MD5

    1c8099bf75f0b18987ddfdde63e52d60

  • SHA1

    d613404fd561ed3bcb44d1d9e949dc08bb7950ca

  • SHA256

    d16719d16c1da558db23766d79a44613e3ca6519d2fc81a167b62d8e39ede0e3

  • SHA512

    7bd7df1775ad0cf9d6be44019104ddde47180da262aabb1c900aa36727c73343c9f33a0e72f5bd119dba4f9937117faac47d0d2dddf1876da1ffb0f4136623c9

Score
3/10
discovery

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\rywcikv.exe
    "C:\Users\Admin\AppData\Local\Temp\rywcikv.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4304
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 492
      2⤵
      • Program crash
      PID:4384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4304 -ip 4304
    1⤵
      PID:2472

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads