Analysis

  • max time kernel
    141s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 09:21

General

  • Target

    78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe

  • Size

    72KB

  • MD5

    f0b567179d42d5d4f27d6d9a7fcf183f

  • SHA1

    fb91a4f85ad3576110cdb476b0eb94c2e14a4e1b

  • SHA256

    78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b

  • SHA512

    ca5afd8671f79d1ee55d51aa75330daac87e4cb116b5b8f60d5be2ed1f21a1e0cbd9e4c613a3c20850bfd0bba78358e4289258f010b6d3c8c169b7a80998c64c

  • SSDEEP

    768:Xf+vj1VHjoFW+gh2vHa0uTbPKYlNnYVbUnWfTMuRqj2O4sO2ieFZ0F:G71NoFhDHaT/CukbUWdfO4LFeP0F

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
    "C:\Users\Admin\AppData\Local\Temp\78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\gmzfwuiqufrhwpcnpfgxukxxsmcqaeed

    Filesize

    16B

    MD5

    4acd7dda805e21f032f1f0849bb59a12

    SHA1

    531888b8c32ef3c86eec8e98c8bd714a821da2ba

    SHA256

    ccf28b26d1e4ab26f6d29cc7a570c108307d25eea19de7efcbf6e8170e13aec2

    SHA512

    e8a41c92d7521257be30280d5053fdc44dbdbab3afad8da7eb915029b0d252ce3885133fd420c98e3ccc89c7431853643b7326c2ae954435946b9fcd527cd76f

  • memory/2912-1-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2912-0-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2912-2-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2912-3-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2912-7-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB