d9b33203556fafab59ac2a86ffc481da83dab9a29293639098cefd15fd686628

Resubmissions

14/03/2025, 13:03

250314-qacneavkv5 10

Analysis

max time kernel
104s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/03/2025, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rust_22_02_2023_gnp.exe
Size

430KB
MD5

3d560af86d945afc16c077829c552d96
SHA1

c2c4bcde91ce300e74c9412324950cb933855d5c
SHA256

60c185a806fafb422876ecb935529aa2b863499c8ed3388ffa3a6ce6e69582f5
SHA512

40dda545cd100fd634ba683e1f0c78afa68234ac78f5bcc3b41aa5af400cf4db4cc7dbd2ebc2b80988c1c5f9b688a2feb89145c0d585372ac91dab4b41ce69f0
SSDEEP

6144:kTouKrWBEu3/Z2lpGDHU3ykJkcerm6bJjL7jg3vcwEg3+GGwRZKnPYR1iitepPHc:kToPWBv/cpGrU3yBiVaJj7TZg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rust_22_02_2023_gnp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	Rust_22_02_2023_gnp.exe

C:\Users\Admin\AppData\Local\Temp\Rust_22_02_2023_gnp.exe
"C:\Users\Admin\AppData\Local\Temp\Rust_22_02_2023_gnp.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...