Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:38
Behavioral task
behavioral1
Sample
d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe
Resource
win10v2004-20241007-en
General
-
Target
d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe
-
Size
164KB
-
MD5
e953218b46ccaf9cf51a53b215f434f0
-
SHA1
dc420734fb52d37fc842e00660b19ef9946927a0
-
SHA256
d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70
-
SHA512
53f9bbe2d8766d0c8835388bf77e36944a8f0ada4963d7b0df6e53effe073e364e7a06cb16dbb2a6301877f668639a18d18d951ef09972103e42c9e3ffa1b5d0
-
SSDEEP
3072:ospj32rVxXeD9K3Mw8H4rZRZl9vY8zR3ZfZrAQf0ob9:o4aoUMwC4119vYS3ZG
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1096 d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe 1096 d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe"C:\Users\Admin\AppData\Local\Temp\d06119288887a7b5ab171764355d33ee5468d044f90d1389df4599abf1bdbf70.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1096