Analysis
-
max time kernel
92s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 14:56
Static task
static1
Behavioral task
behavioral1
Sample
Kuraue/047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Kuraue/047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Kuraue/10d901f924e9009c88e2021c8ab55a029743a682df01de2f1fb4227afe8ceb82.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Kuraue/10d901f924e9009c88e2021c8ab55a029743a682df01de2f1fb4227afe8ceb82.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Kuraue/873782499615a3825a38623440408cc78ac6ab38d8e05379aa921b9185df4075.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Kuraue/873782499615a3825a38623440408cc78ac6ab38d8e05379aa921b9185df4075.exe
Resource
win10v2004-20241007-en
General
-
Target
Kuraue/047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e.exe
-
Size
26.1MB
-
MD5
170c320c93d35bc45d9e40aade1eed72
-
SHA1
ff266e59805b52e2cd34a35ac283cb5ded37cdba
-
SHA256
047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e
-
SHA512
bdcbdaa47313698621fe9f205129a90ae4b3aa0674e0d9d287d633289c30965f5aa0a04227c2856b558df80259d0107e7a11b6c62ab8e62fb03123b876eb9b46
-
SSDEEP
786432:1UDKaqzEbgd0AyhNSLsij2dpEh9TZJJXmMA:auanD7IsiqpaZJJJA
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4120 047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kuraue\047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e.exe"C:\Users\Admin\AppData\Local\Temp\Kuraue\047bc92d1dd3edd255f4eb31b42b1f1fbc9ce087096652c7c65fa4b14ba26d9e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4120