Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-01-2025 15:19
Static task
static1
Behavioral task
behavioral1
Sample
6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe
Resource
win10v2004-20241007-en
General
-
Target
6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe
-
Size
635KB
-
MD5
9eeaa6c9ce625021ac21b5eb40fb73e7
-
SHA1
459fa22834028579136aebd1327a6ff8b6e654cb
-
SHA256
6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739
-
SHA512
202fa2b529565bdf1e2691a12f3b91d5bc6303b5d926852048ed482a071491e8ecf98cc8be5fd1be743a82400db6a57f3ea4cbfd1eeb0586dcd508ba76b4dc50
-
SSDEEP
12288:lSDeMUQg8x4aKKnpDNsLXfzYoWg4IcQ9y3zf5ju9sis:SeMUQgUlNsvYoWdZtjBu/s
Malware Config
Signatures
-
pid Process 2492 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2492 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2492 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2492 2448 6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe 30 PID 2448 wrote to memory of 2492 2448 6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe 30 PID 2448 wrote to memory of 2492 2448 6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe 30 PID 2448 wrote to memory of 2492 2448 6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe"C:\Users\Admin\AppData\Local\Temp\6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492
-