Analysis
-
max time kernel
94s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 12:33
Behavioral task
behavioral1
Sample
3304-76-0x0000000000B70000-0x0000000001210000-memory.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
General
-
Target
3304-76-0x0000000000B70000-0x0000000001210000-memory.exe
-
Size
6.6MB
-
MD5
8f8f9932cc9dce90448fd9154c0fe126
-
SHA1
43f3a9d8063de0f77cca7641359bc8061d88778f
-
SHA256
082a96fa5d613f85fa6b70c5ce002af540ed4974167c51f7399a6485a1f31f3a
-
SHA512
7ce3eafe6fa31a53ee86e57ab94ad5fb97af9c520e8179f6297e60f9e18534da62ea0ff35ca16d1ac7b0f7ee80e7b57f703821db0796ccabc76fb798acd5fbc1
-
SSDEEP
98304:p6/w3dZHYYDOeRCewdizTqp+BsHV4KWtF7oO:o/3YDO7ewUzMonoO
Malware Config
Signatures
-
Stealc family
-
Program crash 1 IoCs
pid pid_target Process procid_target 964 1044 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3304-76-0x0000000000B70000-0x0000000001210000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3304-76-0x0000000000B70000-0x0000000001210000-memory.exe"C:\Users\Admin\AppData\Local\Temp\3304-76-0x0000000000B70000-0x0000000001210000-memory.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 2202⤵
- Program crash
PID:964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1044 -ip 10441⤵PID:1352