Analysis
- max time kernel
133s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
05/03/2025, 15:52
General
- Target spy-max-master/Spy MAX.exe
- Size 530KB
- Sample250305-tbcatasm15
- SHA256 afbc0414c3778e84d0a23d3a1e934b00fabde4390804702a212c1f1018fffbcf
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\spy-max-master\Spy MAX.exe"C:\Users\Admin\AppData\Local\Temp\spy-max-master\Spy MAX.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 15882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1384 -ip 13841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1384-0-0x00000000751AE000-0x00000000751AF000-memory.dmp
memory/1384-1-0x0000000000820000-0x00000000008AA000-memory.dmp
memory/1384-2-0x0000000005270000-0x000000000530C000-memory.dmp
memory/1384-3-0x0000000005900000-0x0000000005EA4000-memory.dmp
memory/1384-4-0x00000000053F0000-0x0000000005482000-memory.dmp
memory/1384-5-0x0000000005320000-0x000000000532A000-memory.dmp
memory/1384-6-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/1384-7-0x0000000005490000-0x00000000054E6000-memory.dmp
memory/1384-8-0x00000000751A0000-0x0000000075950000-memory.dmp