Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe
Resource
win10v2004-20241007-en
General
-
Target
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe
-
Size
988KB
-
MD5
18df057d5952c7f5366335ff201849b5
-
SHA1
6c421f13a590822d583689221569ceff31f2dbae
-
SHA256
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58
-
SHA512
4533b5078683c46e727dd2462745c5893ad9231fa85165595af4242ff7d849af29b3bf8ec2c7f91f3e03acded594bdc7561545cbaf87edf4fc3ab37e349725de
-
SSDEEP
24576:UL3gqH9oc5KKhWIpBwxgCeg+5LxcvFEgOX9BMN4h7A0:UL3gK9d5KKMIp9CT+5WagODRBd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exepid Process 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exedescription pid Process Token: SeDebugPrivilege 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exedescription pid Process procid_target PID 2652 wrote to memory of 2740 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 30 PID 2652 wrote to memory of 2740 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 30 PID 2652 wrote to memory of 2740 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 30 PID 2652 wrote to memory of 2740 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 30 PID 2652 wrote to memory of 2836 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 31 PID 2652 wrote to memory of 2836 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 31 PID 2652 wrote to memory of 2836 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 31 PID 2652 wrote to memory of 2836 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 31 PID 2652 wrote to memory of 2944 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 32 PID 2652 wrote to memory of 2944 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 32 PID 2652 wrote to memory of 2944 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 32 PID 2652 wrote to memory of 2944 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 32 PID 2652 wrote to memory of 2068 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 33 PID 2652 wrote to memory of 2068 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 33 PID 2652 wrote to memory of 2068 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 33 PID 2652 wrote to memory of 2068 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 33 PID 2652 wrote to memory of 2728 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 34 PID 2652 wrote to memory of 2728 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 34 PID 2652 wrote to memory of 2728 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 34 PID 2652 wrote to memory of 2728 2652 87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"2⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"2⤵PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"2⤵PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"2⤵PID:2068
-
-
C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"C:\Users\Admin\AppData\Local\Temp\87fca3267ca394e5bc414194c7c6dec142ae132921efaa2763c6d15f430d6c58.exe"2⤵PID:2728
-