Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-12-2024 16:20

General

  • Target

    d8a8484ea72353881c82667fdf81ab1238982679cb1556454c212c2cedde8827.exe

  • Size

    130KB

  • MD5

    5d3a43d17c7e654c1b2f242e5ef1be80

  • SHA1

    2a924aa9c7971a021de46f285500e9faf9fb2780

  • SHA256

    d8a8484ea72353881c82667fdf81ab1238982679cb1556454c212c2cedde8827

  • SHA512

    89288ab2480047ca8004cdc380c47d19f186c824911839faac9e2c39bc96a6fe00f50a909f6d17502dce0c7663495beb0fd28c52b22a1cd84a284695548f60b2

  • SSDEEP

    1536:mH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmNJO:6KQJcinxphkG5Q6GdpIOkJHhKRyOXKO

Score
5/10

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8a8484ea72353881c82667fdf81ab1238982679cb1556454c212c2cedde8827.exe
    "C:\Users\Admin\AppData\Local\Temp\d8a8484ea72353881c82667fdf81ab1238982679cb1556454c212c2cedde8827.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1636-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/1636-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/1636-9-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/1636-3-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1636-21-0x0000000000490000-0x0000000000491000-memory.dmp

    Filesize

    4KB

  • memory/1636-41-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/1636-46-0x0000000000416000-0x0000000000417000-memory.dmp

    Filesize

    4KB

  • memory/1636-52-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/1636-58-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/1636-61-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/1636-354-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB