Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 12:13
General
-
Target
e297f8652d4abf4466d7baa057dad7401699ffdb2650aa89c95cf4687613d9bf.exe
-
Size
415KB
-
MD5
099f9cd681582db4220d673f99948ca1
-
SHA1
5569a2099416069d6c52fb8413809ff6518e018a
-
SHA256
e297f8652d4abf4466d7baa057dad7401699ffdb2650aa89c95cf4687613d9bf
-
SHA512
a55034c9ea93f069564fd224e0b4a4b1072143dda810ec8ad6ab85ca12208bc33015d69c02d304efbdccf05fd5f9a97ec0ff5dc6f9fcdfe4d0d5f56d57689693
-
SSDEEP
12288:5e7khPIgXFJvGsulaJ6OmJY63pMgYhnd4qjg:5uWOXlagOmJY63pMg+Kc
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e297f8652d4abf4466d7baa057dad7401699ffdb2650aa89c95cf4687613d9bf.exe"C:\Users\Admin\AppData\Local\Temp\e297f8652d4abf4466d7baa057dad7401699ffdb2650aa89c95cf4687613d9bf.exe"1⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB