Resubmissions

25-11-2024 02:45

241125-c86ggstrbs 10

Analysis

  • max time kernel
    92s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2024 02:45

General

  • Target

    qdRFzx.exe

  • Size

    13KB

  • MD5

    570dda71a3e0e9c60465872fc5931c55

  • SHA1

    e1e8f92739a53f9b7e32fa89969174e386427756

  • SHA256

    a8e7f1d1fb0a4583e8adabc4c44c1cc164fdc6be00eb494aa94e714654ef3c22

  • SHA512

    d84a25ad82f7326c826f2b35bbfc348327423cc3178c767234676a395002edf5dfd43febb57b4e1e1842ed757abb4171b920c085e4cdf32f1f3f5d0b4a36c914

  • SSDEEP

    192:bNYAX3Fk9EGZV3kF+mmY3jjeDqIexhhdq98DSmLAjX30JS0RB1lb7piW3+:bNn1kllkF+mtPeDmxhy98Dvb9iW3

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\qdRFzx.exe
    "C:\Users\Admin\AppData\Local\Temp\qdRFzx.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:5048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5048-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

    Filesize

    4KB

  • memory/5048-1-0x00000000003C0000-0x00000000003CA000-memory.dmp

    Filesize

    40KB

  • memory/5048-2-0x0000000005240000-0x00000000057E4000-memory.dmp

    Filesize

    5.6MB

  • memory/5048-3-0x0000000004D70000-0x0000000004DE6000-memory.dmp

    Filesize

    472KB