Overview

overview

10

Static

static

10

0.exe

windows7-x64

10

0.exe

windows10-2004-x64

10

1.exe

windows7-x64

10

1.exe

windows10-2004-x64

10

3.exe

windows7-x64

3

3.exe

windows10-2004-x64

7

Resubmissions

24/03/2025, 00:06 UTC

250324-adxjzszzez 10

23/03/2025, 20:32 UTC

250323-zbkj3svsc1 10

Analysis

  • max time kernel
    17s
  • max time network
    24s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2025, 20:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3.exe

  • Size

    97KB

  • MD5

    499ccc8d6d7c08e135a91928ccc2fd7a

  • SHA1

    78b2b70ad8e49cd2e8518501a29d1af1e714a16f

  • SHA256

    1fa5d83a5766556cf2ff16ad279e73cb40584746bd388e0a4e818a2cc06613d3

  • SHA512

    0f891ce5fb557a9a03644d83df15f0326f4caef42c00e484b8e88182b6414f419ecf010e66db308b9ea48dbb4544f3cb16338e5d813e98051415dffb7ea7a4c2

  • SSDEEP

    1536:zO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45o7:kzgjO/Zd1RePDmZ8tf05iW4u

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3.exe
    "C:\Users\Admin\AppData\Local\Temp\3.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe" end
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6020

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=00CEA71897BE6A0829BBB2A0965E6BA9; domain=.bing.com; expires=Fri, 17-Apr-2026 20:33:06 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 7CE3BD9BF59444B398B55034CB215557 Ref B: LON04EDGE1111 Ref C: 2025-03-23T20:33:06Z
    date: Sun, 23 Mar 2025 20:33:05 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=00CEA71897BE6A0829BBB2A0965E6BA9
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=26RoMc1GN5upFI48Y26Mg_q1hrXjQtw7c9hnvgR-8_0; domain=.bing.com; expires=Fri, 17-Apr-2026 20:33:06 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6106D3F79A9F4E1D95702AACEFF9365C Ref B: LON04EDGE1111 Ref C: 2025-03-23T20:33:06Z
    date: Sun, 23 Mar 2025 20:33:05 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=00CEA71897BE6A0829BBB2A0965E6BA9; MSPTC=26RoMc1GN5upFI48Y26Mg_q1hrXjQtw7c9hnvgR-8_0
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8EFF9ECF38524F1C9B3A20495C722C27 Ref B: LON04EDGE1111 Ref C: 2025-03-23T20:33:06Z
    date: Sun, 23 Mar 2025 20:33:05 GMT
  • 150.171.28.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid=
    tls, http2
    2.0kB
     9.4kB
     22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8950a17bd753408c9faf73496ad9a824&localId=w:23575595-BCFD-0FE4-454D-37D8579B8EC5&deviceId=6896216935740912&anid=

    HTTP Response

    204
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     148 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.28.10
    150.171.27.10

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1352-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/6020-1-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.