Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2025 14:18

General

  • Target

    KRNL Remake/KRNL Remake.exe

  • Size

    3.5MB

  • MD5

    eac81de18872f7b27bcd18701391d932

  • SHA1

    43d16d2bc7c2da594f082cff18c8cb5988a815d4

  • SHA256

    fd0db4e58b8a1fa05b8cb7f02d4bce5f3f5a6e9a28ef774dda7086b840cc72c3

  • SHA512

    63158849d438da8b5b5b2addfb86705243147fe08e3ca81f9efad642ffaf483c50ac4e5886bf479c59ced068767d3cfdf7b5659aa4f3b050791171118f85642c

  • SSDEEP

    49152:60N0fEE942x58snxIX5q9+/Cp9GLy8W4SVII2UR47Lr0F5SMI7:f0fl42Pbnxz9+6ue8xSVIIdWrYgMI7

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\KRNL Remake\KRNL Remake.exe
    "C:\Users\Admin\AppData\Local\Temp\KRNL Remake\KRNL Remake.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3972-0-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

  • memory/3972-1-0x0000000000C70000-0x0000000000FF4000-memory.dmp

    Filesize

    3.5MB

  • memory/3972-2-0x0000000005F30000-0x00000000064D4000-memory.dmp

    Filesize

    5.6MB

  • memory/3972-3-0x0000000005A20000-0x0000000005AB2000-memory.dmp

    Filesize

    584KB

  • memory/3972-4-0x0000000005980000-0x000000000598A000-memory.dmp

    Filesize

    40KB

  • memory/3972-5-0x0000000005E90000-0x0000000005EE8000-memory.dmp

    Filesize

    352KB

  • memory/3972-6-0x0000000005E70000-0x0000000005E7A000-memory.dmp

    Filesize

    40KB

  • memory/3972-7-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3972-8-0x0000000006530000-0x0000000006572000-memory.dmp

    Filesize

    264KB

  • memory/3972-9-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3972-10-0x0000000008ED0000-0x0000000008F84000-memory.dmp

    Filesize

    720KB

  • memory/3972-11-0x0000000009190000-0x0000000009382000-memory.dmp

    Filesize

    1.9MB

  • memory/3972-14-0x00000000090E0000-0x00000000090EA000-memory.dmp

    Filesize

    40KB

  • memory/3972-15-0x0000000009120000-0x0000000009148000-memory.dmp

    Filesize

    160KB

  • memory/3972-16-0x0000000009110000-0x0000000009118000-memory.dmp

    Filesize

    32KB

  • memory/3972-17-0x0000000009170000-0x0000000009188000-memory.dmp

    Filesize

    96KB

  • memory/3972-18-0x0000000009160000-0x000000000916A000-memory.dmp

    Filesize

    40KB

  • memory/3972-19-0x0000000009590000-0x0000000009598000-memory.dmp

    Filesize

    32KB

  • memory/3972-20-0x0000000009790000-0x000000000979A000-memory.dmp

    Filesize

    40KB

  • memory/3972-21-0x0000000009820000-0x000000000983E000-memory.dmp

    Filesize

    120KB

  • memory/3972-22-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3972-23-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

  • memory/3972-24-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3972-25-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3972-26-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3972-27-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3972-28-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB