Analysis
-
max time kernel
17s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2025, 20:32
Behavioral task
behavioral1
Sample
0.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
1.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
3.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3.exe
Resource
win10v2004-20250314-en
General
-
Target
3.exe
-
Size
97KB
-
MD5
499ccc8d6d7c08e135a91928ccc2fd7a
-
SHA1
78b2b70ad8e49cd2e8518501a29d1af1e714a16f
-
SHA256
1fa5d83a5766556cf2ff16ad279e73cb40584746bd388e0a4e818a2cc06613d3
-
SHA512
0f891ce5fb557a9a03644d83df15f0326f4caef42c00e484b8e88182b6414f419ecf010e66db308b9ea48dbb4544f3cb16338e5d813e98051415dffb7ea7a4c2
-
SSDEEP
1536:zO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45o7:kzgjO/Zd1RePDmZ8tf05iW4u
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation 3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1352 wrote to memory of 6020 1352 3.exe 86 PID 1352 wrote to memory of 6020 1352 3.exe 86 PID 1352 wrote to memory of 6020 1352 3.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe" end2⤵
- System Location Discovery: System Language Discovery
PID:6020
-