Overview
overview
5Static
static
5alternative v3.rar
windows7-x64
3alternative v3.rar
windows10-2004-x64
1alternativ...ve.dll
windows7-x64
3alternativ...ve.dll
windows10-2004-x64
3alternativ...hl.exe
windows7-x64
5alternativ...hl.exe
windows10-2004-x64
5out.exe
windows7-x64
3out.exe
windows10-2004-x64
3alternativ...hd.ini
windows7-x64
1alternativ...hd.ini
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 15:00
Behavioral task
behavioral1
Sample
alternative v3.rar
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
alternative v3.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
alternative v3/alternative.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
alternative v3/alternative.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
alternative v3/alternative.hl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
alternative v3/alternative.hl.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
out.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
out.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
alternative v3/injmthd.ini
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
alternative v3/injmthd.ini
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
alternative v3/alternative.hl.exe
-
Size
179KB
-
MD5
12b9674d5a68f829f20214644e67baa3
-
SHA1
9f2681173105f628c7cb14b57540121c5dc667dd
-
SHA256
88132922084d88a606d4430b1903c2c7d2b48e4b1467253c3a51ed00b05954c6
-
SHA512
c1c47d6d7f2ec3d2cf6a50fe85acab653a4e81d7c56a2f1972f7de0b686272c3cb03f59be9512acb4530b94bbe90d4b81b00682d4413ed62bc69b6033a43a073
-
SSDEEP
3072:O2qkbSLWyjCkRtc8lsAR8Z4GkZypFuX6HNwTBf0aeEus/aL:xH+ayW8fWOCDRY0ouAK
Malware Config
Signatures
-
resource yara_rule behavioral6/memory/2244-0-0x00000000007A0000-0x00000000007FF000-memory.dmp upx behavioral6/memory/2244-1-0x00000000007A0000-0x00000000007FF000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alternative.hl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe 2244 alternative.hl.exe