Overview
overview
10Static
static
7c22b74bb5b...0b.exe
windows7-x64
10c22b74bb5b...0b.exe
windows10-2004-x64
10$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$_13_/PowerRun64.exe
windows7-x64
4$_13_/PowerRun64.exe
windows10-2004-x64
3$_13_/SetACL64.exe
windows7-x64
1$_13_/SetACL64.exe
windows10-2004-x64
1$_13_/bn.bat
windows7-x64
1$_13_/bn.bat
windows10-2004-x64
1$_13_/bn1.bat
windows7-x64
10$_13_/bn1.bat
windows10-2004-x64
10$_13_/bnn.bat
windows7-x64
1$_13_/bnn.bat
windows10-2004-x64
1$_13_/bnz.bat
windows7-x64
1$_13_/bnz.bat
windows10-2004-x64
1$_13_/dotN...up.exe
windows7-x64
7$_13_/dotN...up.exe
windows10-2004-x64
7$_13_/dotN...up.exe
windows7-x64
7$_13_/dotN...up.exe
windows10-2004-x64
7$_13_/mbby...iy.exe
windows7-x64
3$_13_/mbby...iy.exe
windows10-2004-x64
3$_13_/win_...rp.exe
windows7-x64
3$_13_/win_...rp.exe
windows10-2004-x64
3Analysis
-
max time kernel
13s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 16:08
Behavioral task
behavioral1
Sample
c22b74bb5b950a631aab0b48d9480861b6bcd02de2be9cbc9294c760344b430b.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c22b74bb5b950a631aab0b48d9480861b6bcd02de2be9cbc9294c760344b430b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$_13_/PowerRun64.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
$_13_/PowerRun64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$_13_/SetACL64.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$_13_/SetACL64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$_13_/bn.bat
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
$_13_/bn.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$_13_/bn1.bat
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$_13_/bn1.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$_13_/bnn.bat
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$_13_/bnn.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$_13_/bnz.bat
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$_13_/bnz.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$_13_/dotNetFx40_Full_setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$_13_/dotNetFx40_Full_setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$_13_/dotNetFx45_Full_setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$_13_/dotNetFx45_Full_setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$_13_/mbbyfatkrvotaiy.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$_13_/mbbyfatkrvotaiy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$_13_/win_version_csharp.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
$_13_/win_version_csharp.exe
Resource
win10v2004-20241007-en
General
-
Target
$_13_/win_version_csharp.exe
-
Size
6KB
-
MD5
7cb364701028767f8942cc3f8439f8f2
-
SHA1
d6bede2206b7042b4cae32f416e1b43ffac94238
-
SHA256
a2716605f8dd1930808e6918db670a3fe32287791862883dbabd26849b87b09e
-
SHA512
3011b3d64f79280ab05de9658c4f5a13f637ad2e79d5770cfaeb3af6cb8c7a56b610dad69fdf295112be64cfb80e18f30bb1829eb3c0e549105f63d0e770dc13
-
SSDEEP
96:/uidPNKO2mkcQ7DBOrkB0kPkKXwF4dkd8Nue3qYMns1BjgtRQWWzNt:FIOu7DBOrkB0kPkKXwF4dkd8Nn34nUBR
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_version_csharp.exe