Analysis
- max time kernel
95s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
18/02/2025, 14:16
General
- Target XubNiYa2b4TFHal.exe
- Size 1.2MB
- Sample250218-rk73qssp14
- SHA256 33b37dc7c77eeab90f5e561dbf89b3e2967b6477e9071d4ee35c09d4354067ae
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XubNiYa2b4TFHal.exe"C:\Users\Admin\AppData\Local\Temp\XubNiYa2b4TFHal.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XubNiYa2b4TFHal.exe"C:\Users\Admin\AppData\Local\Temp\XubNiYa2b4TFHal.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1592-8-0x00000000749AE000-0x00000000749AF000-memory.dmp
memory/1592-9-0x00000000749A0000-0x0000000075150000-memory.dmp
memory/1592-2-0x0000000005110000-0x00000000056B4000-memory.dmp
memory/1592-3-0x0000000004B60000-0x0000000004BF2000-memory.dmp
memory/1592-4-0x0000000004C00000-0x0000000004F54000-memory.dmp
memory/1592-5-0x00000000749A0000-0x0000000075150000-memory.dmp
memory/1592-6-0x0000000005070000-0x000000000507A000-memory.dmp
memory/1592-7-0x0000000005870000-0x000000000588E000-memory.dmp
memory/1592-1-0x0000000000150000-0x000000000027E000-memory.dmp
memory/1592-10-0x0000000002460000-0x00000000024F2000-memory.dmp
memory/1592-0-0x00000000749AE000-0x00000000749AF000-memory.dmp
memory/1592-11-0x000000000E430000-0x000000000E4CC000-memory.dmp
memory/1592-14-0x00000000749A0000-0x0000000075150000-memory.dmp
memory/1656-12-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1656-15-0x0000000001760000-0x0000000001AAA000-memory.dmp
memory/1656-16-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1656-17-0x0000000000400000-0x0000000000447000-memory.dmp