Overview

overview

10

Static

static

10

malware/EinTT.exe

windows7-x64

10

malware/EinTT.exe

windows10-2004-x64

10

malware/fox.exe

windows7-x64

3

malware/fox.exe

windows10-2004-x64

3

malware/guJPO.exe

windows7-x64

10

malware/guJPO.exe

windows10-2004-x64

10

malware/loader1.exe

windows7-x64

10

malware/loader1.exe

windows10-2004-x64

7

dnjdbaa.exe

windows7-x64

3

dnjdbaa.exe

windows10-2004-x64

3

malware/regasm.exe

windows7-x64

10

malware/regasm.exe

windows10-2004-x64

10

malware/vbc.exe

windows7-x64

10

malware/vbc.exe

windows10-2004-x64

7

rywcikv.exe

windows7-x64

3

rywcikv.exe

windows10-2004-x64

3

malware/vbc1.exe

windows7-x64

10

malware/vbc1.exe

windows10-2004-x64

7

eblupydfzx.exe

windows7-x64

3

eblupydfzx.exe

windows10-2004-x64

3

malware/vbc2.exe

windows7-x64

10

malware/vbc2.exe

windows10-2004-x64

7

ioatgumevw.exe

windows7-x64

3

ioatgumevw.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    95s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 20:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ioatgumevw.exe

  • Size

    4KB

  • MD5

    f88371b8ec4dc631943fe54a227707dc

  • SHA1

    a127b7a645f9468105a31109a3572960004a7316

  • SHA256

    6ea31176202a06bbfd787b91c64c8ac55cd8e2c817e37d556576133334a3614b

  • SHA512

    b4d04bf47e643845e97da626f62dcd5ac3611508300769bb2840fbde88ecbc2229cadd0ef3b2b50ab36042e9e31c71211e4d335871f15840ec5aa3bd5244c1ef

Score
3/10
discovery

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\ioatgumevw.exe
    "C:\Users\Admin\AppData\Local\Temp\ioatgumevw.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1820
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 492
      2⤵
      • Program crash
      PID:1484
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1820 -ip 1820
    1⤵
      PID:1528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads