Analysis

  • max time kernel
    141s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 09:21

General

  • Target

    80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe

  • Size

    68KB

  • MD5

    b1024afccaf9847146e611beab995356

  • SHA1

    310a31da48325cea02182158efe0daa2ac6b451d

  • SHA256

    80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2

  • SHA512

    164d5b81008251a454e0cc18ebbaaa3c1ce9f3dd24d45650359db5e4b30f00bd889f88333b2290e86667aa00296dea57f7b016d85f79ba12ea38eb6bd1342244

  • SSDEEP

    1536:h3C4HGFE94jwEG/eO5VEx70AwAWkH+/z13+QDmsrxwSX:hNoESj8p5OeFAWp7p+Qbxr

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
    "C:\Users\Admin\AppData\Local\Temp\80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\xedwccxvxjdrmpsrukbdmumycqumjwgq

    Filesize

    16B

    MD5

    720ffbd7c4e1e136bc524c0f3315be5a

    SHA1

    d97a4c5256f6936226dfc01a6f2681ead44f762e

    SHA256

    c5ee84be2172fe70689f3716ddd55d39e1d177a76e1ed4844df7feb2d7ad5064

    SHA512

    c40fff39128002ecf9fc9fbe1af645bbddf6264676aafd4a1f2db780271bd2c7f26e17dea299f5baf515a0524dd4aca59e476a1591c53120fb999cc74a36e8b4

  • memory/2196-0-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2196-1-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2196-2-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2196-3-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2196-7-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB