Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 11:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe
Resource
win7-20241010-en
5 signatures
120 seconds
General
-
Target
7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe
-
Size
927KB
-
MD5
797c53ab8096a9a97d91bd8b4b25aea0
-
SHA1
36f56d955c6bcf22b4d6391b61af1c6754b3d29a
-
SHA256
7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5
-
SHA512
ea1a7512e42361aa6d08b8107e15a3419e0de4c8fdb8f96f2473dc3279f46ef010fa46fc8910d57a4e3b214b0f7da0e3bbb6241bcf0181978a722d63c5bc05f8
-
SSDEEP
24576:RjkqcetqSd1ELP34MYTNvyvzEYoo+iiNuZXL:xkqjtqSDELPYsbH
Malware Config
Signatures
-
Expiro family
-
Expiro payload 1 IoCs
resource yara_rule behavioral1/memory/2256-3-0x0000000000400000-0x00000000006B6000-memory.dmp family_expiro1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2256 7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe 2256 7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe 2256 7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe 2256 7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe 2256 7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe 2256 7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe"C:\Users\Admin\AppData\Local\Temp\7ee11f85e1380cc197c7f86485756207e10e5aaa59f9646dae981641113ff2a5N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2256