Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 02:32

General

  • Target

    4ec5b3be5d6a5039ec5c725a8da4290f6faf51e744c4b6441c9e625dbe7cc88e.exe

  • Size

    44KB

  • MD5

    1147fdf9a4f5f4dcdbdd6c080c88e083

  • SHA1

    753e81bcdb1750a4cc0d34093fe2cd5f5512d77a

  • SHA256

    4ec5b3be5d6a5039ec5c725a8da4290f6faf51e744c4b6441c9e625dbe7cc88e

  • SHA512

    1bcae2918af561663d07fe3ebf1caa7f4d921185b8cf62ee93e70c7df6142cd07163eaf50000d6b516b9215aee09d04b9f5a579fcd5f655895d0ffd5ede534b7

  • SSDEEP

    768:1IVFJHupNktBnTqwCRMrhmwpdueYN2/JRFHvOrogqT1Udf18KUknBAJ7:1IFHupNkvTqw2ghmwHYNchvO8gq6fVUt

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ec5b3be5d6a5039ec5c725a8da4290f6faf51e744c4b6441c9e625dbe7cc88e.exe
    "C:\Users\Admin\AppData\Local\Temp\4ec5b3be5d6a5039ec5c725a8da4290f6faf51e744c4b6441c9e625dbe7cc88e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 1124
      2⤵
      • Program crash
      PID:5936

Network

  • flag-vn
    GET
    http://160.22.121.182/STATO/Vskhdvzxu.mp3
    4ec5b3be5d6a5039ec5c725a8da4290f6faf51e744c4b6441c9e625dbe7cc88e.exe
    Remote address:
    160.22.121.182:80
    Request
    GET /STATO/Vskhdvzxu.mp3 HTTP/1.1
    Host: 160.22.121.182
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 02:32:21 GMT
    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
    Last-Modified: Fri, 20 Dec 2024 01:44:41 GMT
    ETag: "ea408-629a9ca58f463"
    Accept-Ranges: bytes
    Content-Length: 959496
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: audio/mpeg
  • 160.22.121.182:80
    http://160.22.121.182/STATO/Vskhdvzxu.mp3
    http
    4ec5b3be5d6a5039ec5c725a8da4290f6faf51e744c4b6441c9e625dbe7cc88e.exe
    18.6kB
    988.2kB
    395
    710

    HTTP Request

    GET http://160.22.121.182/STATO/Vskhdvzxu.mp3

    HTTP Response

    200
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2932-0-0x000000007466E000-0x000000007466F000-memory.dmp

    Filesize

    4KB

  • memory/2932-1-0x0000000000360000-0x0000000000370000-memory.dmp

    Filesize

    64KB

  • memory/2932-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-3-0x00000000060E0000-0x00000000061D0000-memory.dmp

    Filesize

    960KB

  • memory/2932-4-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-5-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-22-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-31-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-7-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-39-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-59-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-57-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-55-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-9-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-53-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-47-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-11-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-13-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-15-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-17-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-45-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-51-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-49-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-67-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-65-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-63-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-62-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-43-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-41-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-37-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-35-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-33-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-29-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-27-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-25-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-23-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-19-0x00000000060E0000-0x00000000061CB000-memory.dmp

    Filesize

    940KB

  • memory/2932-1180-0x0000000074660000-0x0000000074D4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-1181-0x0000000005610000-0x0000000005672000-memory.dmp

    Filesize

    392KB

  • memory/2932-1182-0x0000000004C60000-0x0000000004CAC000-memory.dmp

    Filesize

    304KB

  • memory/2932-1183-0x000000007466E000-0x000000007466F000-memory.dmp

    Filesize

    4KB

  • memory/2932-1184-0x0000000074660000-0x0000000074D4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-1185-0x0000000074660000-0x0000000074D4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-1186-0x0000000004DA0000-0x0000000004DF4000-memory.dmp

    Filesize

    336KB

  • memory/2932-1187-0x0000000074660000-0x0000000074D4E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.