Resubmissions
12/05/2025, 21:57
250512-1tzbmaxrw325/04/2025, 20:13
250425-yzes3asnt91025/04/2025, 14:50
250425-r7qf7syks31025/04/2025, 14:35
250425-ryf66svsby1025/04/2025, 14:30
250425-rvmjsaxrw51024/04/2025, 16:38
250424-t5sjws1rw61014/04/2025, 07:51
250414-jp1kfssjz91014/04/2025, 07:46
250414-jl9nyssjt91008/04/2025, 15:58
250408-tevasswl181008/04/2025, 14:19
250408-rm2nqsvqw210Analysis
- max time kernel
104s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20250410-en - resource tags
- submitted
25/04/2025, 14:35
General
- Target f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950.exe
- Size 3.0MB
- Sample250425-ryf66svsby
- SHA256 f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950.exe"C:\Users\Admin\AppData\Local\Temp\f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 14442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2020 -ip 20201⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2020-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmp
memory/2020-1-0x00000000009F0000-0x0000000000AFE000-memory.dmp
memory/2020-2-0x00000000054C0000-0x00000000055BE000-memory.dmp
memory/2020-3-0x0000000074E20000-0x00000000755D0000-memory.dmp
memory/2020-11-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-35-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-33-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-59-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-57-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-31-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-29-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-43-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-37-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-27-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-25-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-23-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-21-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-19-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-17-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-15-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-13-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-9-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-67-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-65-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-63-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-61-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-55-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-53-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-51-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-49-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-47-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-45-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-41-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-39-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-7-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-5-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-4-0x00000000054C0000-0x00000000055B8000-memory.dmp
memory/2020-1340-0x0000000074E20000-0x00000000755D0000-memory.dmp
memory/2020-1341-0x0000000005630000-0x0000000005688000-memory.dmp
memory/2020-1342-0x00000000056F0000-0x0000000005744000-memory.dmp
memory/2020-1343-0x0000000005740000-0x000000000578C000-memory.dmp
memory/2020-1346-0x0000000005820000-0x0000000005874000-memory.dmp
memory/2020-1345-0x0000000006080000-0x0000000006624000-memory.dmp
memory/2020-1344-0x0000000074E20000-0x00000000755D0000-memory.dmp
memory/2020-1347-0x0000000074E20000-0x00000000755D0000-memory.dmp