Overview

overview

10

Static

static

3

60f58b0bf4...02.exe

windows7-x64

10

60f58b0bf4...02.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    60s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2025, 19:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    60f58b0bf4822a12719e9021586daaaa9fb8ff9fa14f11323a5108903499e502.exe

  • Size

    1.5MB

  • MD5

    ae441dd27c4e87959a5dec0414b822b4

  • SHA1

    c81511b544ee038131b5493d7570fa3be4d495fd

  • SHA256

    60f58b0bf4822a12719e9021586daaaa9fb8ff9fa14f11323a5108903499e502

  • SHA512

    f650a0cb435e09fd7a69a2e831c9a41ab30a895fa11bc5008e6ba30249ec5ec73f56cb14d12837f6e000e63eb6bd3e7b77c16f9dd299250af4cb3b54bd3d1c78

  • SSDEEP

    24576:x0QtEHBwGurDs4vBFKkRLF4SeOJv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:x0Q8NXkKeF4SdjLoyEkmZ9Y14

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60f58b0bf4822a12719e9021586daaaa9fb8ff9fa14f11323a5108903499e502.exe
    "C:\Users\Admin\AppData\Local\Temp\60f58b0bf4822a12719e9021586daaaa9fb8ff9fa14f11323a5108903499e502.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4604

Network

  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    167.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.190.18.2.in-addr.arpa
    IN PTR
    Response
    167.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-167deploystaticakamaitechnologiescom
No results found
  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    68.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    68.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    167.190.18.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    167.190.18.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4604-0-0x000000007452E000-0x000000007452F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4604-1-0x0000000000590000-0x000000000070C000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/4604-2-0x00000000055F0000-0x0000000005B94000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4604-3-0x0000000005040000-0x00000000050D2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4604-5-0x0000000074520000-0x0000000074CD0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4604-4-0x0000000004FD0000-0x0000000004FDA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4604-6-0x0000000004FC0000-0x0000000004FC8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4604-7-0x0000000005250000-0x00000000052F2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/4604-8-0x0000000005390000-0x000000000542C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4604-9-0x0000000004FF0000-0x0000000005006000-memory.dmp

    Filesize

    88KB

    Download

  • memory/4604-10-0x0000000005530000-0x0000000005596000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4604-11-0x000000007452E000-0x000000007452F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4604-12-0x0000000074520000-0x0000000074CD0000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.