Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 19:34

General

  • Target

    $TEMP/sqlite3.exe

  • Size

    540KB

  • MD5

    a64716590df9688a6734e2ba8d284692

  • SHA1

    d11c6d022f922eb5682b40b5268fe55d42cdf45a

  • SHA256

    5de7753f74d0b683a507cb86bcc27cb92663163104635bea9d497ed741ba6000

  • SHA512

    eddb084a6805249b7b1b9982c41e731c92ff2240f9d0304a28e473c8ea37013f066b968e31e523b50e3e47ce9f94bc0e6853819e4935bbc120c1a8c9162a24f9

  • SSDEEP

    12288:BjYXXrzNtEJxlQqK0VgOEHi5Mrm3HzAwJdrhpV/7x:BO/NtEjlFVgObWrmXzAwJpV/7x

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3472

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3472-0-0x0000000000400000-0x0000000000476000-memory.dmp

          Filesize

          472KB