Analysis
- max time kernel
93s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/12/2024, 21:31
General
- Target rOrdendecompra36530PI-18789.exe
- Size 744KB
- Sample241210-1c14wsvmfm
- SHA256 2f879c2a7e74ec4e9bdee9f54d1279c78b2646eb95499f5bdd1fa4d2ac816a5b
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rOrdendecompra36530PI-18789.exe"C:\Users\Admin\AppData\Local\Temp\rOrdendecompra36530PI-18789.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 12802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1972 -ip 19721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1972-0-0x000000007466E000-0x000000007466F000-memory.dmp
memory/1972-1-0x0000000000520000-0x00000000005DC000-memory.dmp
memory/1972-2-0x00000000054F0000-0x0000000005A94000-memory.dmp
memory/1972-3-0x0000000004FE0000-0x0000000005072000-memory.dmp
memory/1972-4-0x0000000005170000-0x000000000517A000-memory.dmp
memory/1972-5-0x0000000005250000-0x00000000052EC000-memory.dmp
memory/1972-6-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/1972-7-0x0000000005440000-0x000000000545E000-memory.dmp
memory/1972-8-0x000000007466E000-0x000000007466F000-memory.dmp
memory/1972-9-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/1972-10-0x0000000006490000-0x0000000006496000-memory.dmp
memory/1972-11-0x0000000074660000-0x0000000074E10000-memory.dmp