Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:15

General

  • Target

    b022d9e4ed0716b265fec7cac8a8b3d9.exe

  • Size

    9.5MB

  • MD5

    b022d9e4ed0716b265fec7cac8a8b3d9

  • SHA1

    06186c33e890e938a38ab244e2b5a5a96cbe03ab

  • SHA256

    213700faddee1ca46428597c9011cf189a5c5ce20b4fbf7cdc5cb047d37f3cbe

  • SHA512

    92a0c2404ddec21b10884b963d9ca012c971b2b736004563c3fbdfa097ad5bec4de050f3f4b3781e98a836c8a07840d2ab74cb70ad4b986b8c51cc2df81b2e02

  • SSDEEP

    1536:5+2CEf8o9ppJ96zWkMzppJY6zWk3KEKclR:jCEf8sppX6zJippm6zJ3KLYR

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b022d9e4ed0716b265fec7cac8a8b3d9.exe
    "C:\Users\Admin\AppData\Local\Temp\b022d9e4ed0716b265fec7cac8a8b3d9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2976-0-0x00000000750AE000-0x00000000750AF000-memory.dmp

    Filesize

    4KB

  • memory/2976-1-0x0000000000DF0000-0x000000000177C000-memory.dmp

    Filesize

    9.5MB

  • memory/2976-2-0x00000000067A0000-0x0000000006D44000-memory.dmp

    Filesize

    5.6MB

  • memory/2976-3-0x0000000006140000-0x00000000061D2000-memory.dmp

    Filesize

    584KB

  • memory/2976-4-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/2976-5-0x0000000006220000-0x000000000622A000-memory.dmp

    Filesize

    40KB

  • memory/2976-6-0x00000000750AE000-0x00000000750AF000-memory.dmp

    Filesize

    4KB

  • memory/2976-7-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB