Overview
overview
10Static
static
10Malware-1-...30.exe
windows11-21h2-x64
10Malware-1-...40.exe
windows11-21h2-x64
10Malware-1-...32.exe
windows11-21h2-x64
10Malware-1-.../5.exe
windows11-21h2-x64
10Malware-1-...91.exe
windows11-21h2-x64
10Malware-1-...ey.exe
windows11-21h2-x64
7Malware-1-...ad.exe
windows11-21h2-x64
3Malware-1-...ti.exe
windows11-21h2-x64
5Malware-1-...an.bat
windows11-21h2-x64
7Malware-1-...an.exe
windows11-21h2-x64
5Malware-1-...ve.bat
windows11-21h2-x64
7Malware-1-...ve.exe
windows11-21h2-x64
6Malware-1-...ya.exe
windows11-21h2-x64
Malware-1-...re.exe
windows11-21h2-x64
10Malware-1-...ry.exe
windows11-21h2-x64
10Malware-1-...ck.exe
windows11-21h2-x64
3Malware-1-...he.exe
windows11-21h2-x64
10Malware-1-...op.exe
windows11-21h2-x64
7Malware-1-...rb.exe
windows11-21h2-x64
10Malware-1-...ue.exe
windows11-21h2-x64
1Malware-1-...ng.exe
windows11-21h2-x64
6Malware-1-...kt.bat
windows11-21h2-x64
7Malware-1-...o3.exe
windows11-21h2-x64
10Malware-1-...ey.exe
windows11-21h2-x64
10Malware-1-.../m.exe
windows11-21h2-x64
Malware-1-...o3.exe
windows11-21h2-x64
9Malware-1-...32.exe
windows11-21h2-x64
10Malware-1-...nf.exe
windows11-21h2-x64
10Malware-1-.../o.exe
windows11-21h2-x64
3Malware-1-...B8.exe
windows11-21h2-x64
10Malware-1-...ig.exe
windows11-21h2-x64
10Malware-1-...rv.exe
windows11-21h2-x64
10Analysis
-
max time kernel
897s -
max time network
902s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/01/2025, 13:33
Behavioral task
behavioral1
Sample
Malware-1-master/2530.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Malware-1-master/2887140.exe
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Malware-1-master/32.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Malware-1-master/5.exe
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Malware-1-master/96591.exe
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Malware-1-master/Amadey.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
Malware-1-master/Download.exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
Malware-1-master/Illuminati.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
Malware-1-master/MEMZ-Clean.bat
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
Malware-1-master/MEMZ-Clean.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
Malware-1-master/MEMZ-Destructive.bat
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
Malware-1-master/MEMZ-Destructive.exe
Resource
win11-20241023-en
Behavioral task
behavioral13
Sample
Malware-1-master/Petya.exe
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
Malware-1-master/Software.exe
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
Malware-1-master/WannaCry.exe
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
Malware-1-master/Win32.EvilClusterFuck.exe
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
Malware-1-master/apache.exe
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
Malware-1-master/butterflyondesktop.exe
Resource
win11-20241023-en
Behavioral task
behavioral19
Sample
Malware-1-master/crb.exe
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
Malware-1-master/eternalblue.exe
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
Malware-1-master/fear.png.exe
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
Malware-1-master/getr3kt.bat
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
Malware-1-master/iimo3.exe
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
Malware-1-master/jey.exe
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
Malware-1-master/m.exe
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
Malware-1-master/mo3.exe
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
Malware-1-master/mo332.exe
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
Malware-1-master/mysqlconf.exe
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
Malware-1-master/o.exe
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
Malware-1-master/qOA7iZJcoB8.exe
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
Malware-1-master/rig.exe
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
Malware-1-master/sserv.exe
Resource
win11-20241007-en
General
-
Target
Malware-1-master/qOA7iZJcoB8.exe
-
Size
400KB
-
MD5
7a58e7f8cd91b372af614ffe5db58eca
-
SHA1
8e341ffcfcb4b60b93700996b037c35f0221ec39
-
SHA256
6b111be3c180de78849b4f1c2d39ee0045695e22d339b50879a769351b1e6b31
-
SHA512
c89d62ddcc79d0e1a42dc090b3a149483e91f61c9aa9aaa489535dc32462d55d6accc2f55a255c42579c89a78afdd62f271dbcb4aab6c075b8cb70f6a143b5bf
-
SSDEEP
3072:bQgo+/qo6aiN3HKwkRF9kl+BHpQB8ID0msCJhp4Swm5WXDtVL3d0:2+/qo6f9kRFyl+BJM8ID0pCr/wm5S
Malware Config
Signatures
-
Emotet family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qOA7iZJcoB8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qOA7iZJcoB8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cachinglatin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cachinglatin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2780 qOA7iZJcoB8.exe 2780 qOA7iZJcoB8.exe 4904 qOA7iZJcoB8.exe 4904 qOA7iZJcoB8.exe 1444 cachinglatin.exe 1444 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe 4252 cachinglatin.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4904 qOA7iZJcoB8.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2780 wrote to memory of 4904 2780 qOA7iZJcoB8.exe 77 PID 2780 wrote to memory of 4904 2780 qOA7iZJcoB8.exe 77 PID 2780 wrote to memory of 4904 2780 qOA7iZJcoB8.exe 77 PID 1444 wrote to memory of 4252 1444 cachinglatin.exe 79 PID 1444 wrote to memory of 4252 1444 cachinglatin.exe 79 PID 1444 wrote to memory of 4252 1444 cachinglatin.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\qOA7iZJcoB8.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\qOA7iZJcoB8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\qOA7iZJcoB8.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\qOA7iZJcoB8.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4904
-
-
C:\Windows\SysWOW64\cachinglatin.exe"C:\Windows\SysWOW64\cachinglatin.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cachinglatin.exe"C:\Windows\SysWOW64\cachinglatin.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4252
-