b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
97s
max time network
165s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04/01/2025, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Email-Worm/Maldal.a.exe
Size

80KB
MD5

cbcd34a252a7cf61250b0f7f1cba3382
SHA1

152f224d66555dd49711754bf4e29a17f4706332
SHA256

abac285f290f0cfcd308071c9dfa9b7b4b48d10b4a3b4d75048804e59a447787
SHA512

09fdcb04707a3314e584f81db5210b2390f4c3f5efa173539f9d248db48ae26b3a8b240cf254561b0ecb764f6b04bb4c129832c6502d952d1960e443371ce2a9
SSDEEP

1536:wh6S2wzALFx8hkMsiUmxi6QPitAKQjY8c4B5h:dS212xlQvKCYx4B

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DALLAH.exe	Maldal.a.exe
File opened for modification	C:\Windows\SysWOW64\DALLAH.exe	Maldal.a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\LucKey.exe	Maldal.a.exe
File opened for modification	C:\Windows\LucKey.exe	Maldal.a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maldal.a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2604	Maldal.a.exe

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Maldal.a.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Maldal.a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Sharoon 1.exe

Filesize
80KB

MD5
cbcd34a252a7cf61250b0f7f1cba3382

SHA1
152f224d66555dd49711754bf4e29a17f4706332

SHA256
abac285f290f0cfcd308071c9dfa9b7b4b48d10b4a3b4d75048804e59a447787

SHA512
09fdcb04707a3314e584f81db5210b2390f4c3f5efa173539f9d248db48ae26b3a8b240cf254561b0ecb764f6b04bb4c129832c6502d952d1960e443371ce2a9

Download Submit