Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2025 03:27
Behavioral task
behavioral1
Sample
4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe
Resource
win10v2004-20241007-en
General
-
Target
4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe
-
Size
349KB
-
MD5
1a39c54b65bc03a26fcf969bf55e4ab7
-
SHA1
155ee381343b1f8266ea9f170162d55eeb11ff22
-
SHA256
4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf
-
SHA512
cadd31d16810a3068f7329e7aef75e1cdf0cc85215a0189c650e362235eda56497dae8af3af603ba9f78dec2987b0b8a0697a623aa59263e2ef876124cdd4d13
-
SSDEEP
6144:UsLqdufVUNDaq5/uqlCWuXecmE4b3eJRB/m:PFUNDa0uqlCWXcmEAeJRBm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe 4872 4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe"C:\Users\Admin\AppData\Local\Temp\4bbae91c62252288b6d7eac4efc6bcc90295aeab5596047e1e0725b4fa955caf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4872