Analysis
-
max time kernel
81s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 15:12
Static task
static1
Behavioral task
behavioral1
Sample
6b956ca5060d8097725114bcbadc8e1db7975b7563aeac1a0cf6bc081c45c508.exe
Resource
win7-20241010-en
General
-
Target
6b956ca5060d8097725114bcbadc8e1db7975b7563aeac1a0cf6bc081c45c508.exe
-
Size
240KB
-
MD5
3e338ce89113b61841da9ca7eff88ba3
-
SHA1
919a796646d14fc1364d9ec8d40755fcd768c96f
-
SHA256
6b956ca5060d8097725114bcbadc8e1db7975b7563aeac1a0cf6bc081c45c508
-
SHA512
d88b59dc5c8103279211f4f3978c899ec04e24edc6da53cbdbfdfdf4f5e44d2c265e39206b3f783634778a06d67fb8da009657602bcf1f0cf5fa2f8f7e497671
-
SSDEEP
3072:1g2TyR3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCPouT+3GhZBTZ7F0g9cfQ:17+qcWxc5tTBsJWKFGUOfCPoO7ZBt3v
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b956ca5060d8097725114bcbadc8e1db7975b7563aeac1a0cf6bc081c45c508.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3040 6b956ca5060d8097725114bcbadc8e1db7975b7563aeac1a0cf6bc081c45c508.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b956ca5060d8097725114bcbadc8e1db7975b7563aeac1a0cf6bc081c45c508.exe"C:\Users\Admin\AppData\Local\Temp\6b956ca5060d8097725114bcbadc8e1db7975b7563aeac1a0cf6bc081c45c508.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3040