Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Benetti yacht Enquiry.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Benetti yacht Enquiry.exe
-
Size
1.1MB
-
MD5
ea25c184df955f5e4382ce73fe3eb6bb
-
SHA1
da5ed9ab355a3e5912c3186e3c372b68ffddd8c1
-
SHA256
b4932161d592d2b1c33be7ef495b873434ea47f9031e44b31338a041b22394ba
-
SHA512
7fc6bce7097865be62bf45064120e24bbfef026adcef39ad99dbb6533fd7c4de471a67c5982ca930ba8955e991fa92fdca12c8bf1c3f97c0b9077c8a82b661b5
-
SSDEEP
24576:cFOsBgo0q4wMMBmCmTOUd+L6kaXWUp5xzc0B4p+v/5QjK5pqiebU:cEoHMUmCm6Ud+zaXPJcaW+H5QjspqieQ
Score
9/10
Malware Config
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral1/memory/1748-3-0x0000000000940000-0x0000000000952000-memory.dmp CustAttr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Benetti yacht Enquiry.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe 1748 Benetti yacht Enquiry.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1748 Benetti yacht Enquiry.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2640 1748 Benetti yacht Enquiry.exe 31 PID 1748 wrote to memory of 2640 1748 Benetti yacht Enquiry.exe 31 PID 1748 wrote to memory of 2640 1748 Benetti yacht Enquiry.exe 31 PID 1748 wrote to memory of 2640 1748 Benetti yacht Enquiry.exe 31 PID 1748 wrote to memory of 2652 1748 Benetti yacht Enquiry.exe 32 PID 1748 wrote to memory of 2652 1748 Benetti yacht Enquiry.exe 32 PID 1748 wrote to memory of 2652 1748 Benetti yacht Enquiry.exe 32 PID 1748 wrote to memory of 2652 1748 Benetti yacht Enquiry.exe 32 PID 1748 wrote to memory of 1256 1748 Benetti yacht Enquiry.exe 33 PID 1748 wrote to memory of 1256 1748 Benetti yacht Enquiry.exe 33 PID 1748 wrote to memory of 1256 1748 Benetti yacht Enquiry.exe 33 PID 1748 wrote to memory of 1256 1748 Benetti yacht Enquiry.exe 33 PID 1748 wrote to memory of 3008 1748 Benetti yacht Enquiry.exe 34 PID 1748 wrote to memory of 3008 1748 Benetti yacht Enquiry.exe 34 PID 1748 wrote to memory of 3008 1748 Benetti yacht Enquiry.exe 34 PID 1748 wrote to memory of 3008 1748 Benetti yacht Enquiry.exe 34 PID 1748 wrote to memory of 3016 1748 Benetti yacht Enquiry.exe 35 PID 1748 wrote to memory of 3016 1748 Benetti yacht Enquiry.exe 35 PID 1748 wrote to memory of 3016 1748 Benetti yacht Enquiry.exe 35 PID 1748 wrote to memory of 3016 1748 Benetti yacht Enquiry.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"2⤵PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"2⤵PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"2⤵PID:1256
-
-
C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"2⤵PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"C:\Users\Admin\AppData\Local\Temp\Benetti yacht Enquiry.exe"2⤵PID:3016
-