Analysis
-
max time kernel
30s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-11-2024 10:04
General
-
Target
rh_0.4.9.exe
-
Size
456KB
-
MD5
101c823784ccb04983205c7e006ac89a
-
SHA1
4b983830e4c2c8f9dc3081828d936e51fe2fe3a5
-
SHA256
603dd803082a1d92a46319990eb7fadc16a9ba223a605d1f7c6e31f11c2b03e5
-
SHA512
c66e4506620285530e034edecf3fe4a56036a2b3bb57fa285c395017bb8687303c8880f637abe16c785801d030a458e80c449f4f61774bc39b5eaf9000f01a5b
-
SSDEEP
6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+u:2uWP/BZUyoLu8Agsmxwrvejkd2
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe"C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses