Analysis
- max time kernel
101s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
28/05/2025, 07:50
General
- Target download_fin.exe
- Size 2.6MB
- Sample250528-jplfjas1aw
- SHA256 e61e2ad639c8156f8e10ba5d91b7c364091163d15fca4ef15d71e3d56411ea5b
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download_fin.exe"C:\Users\Admin\AppData\Local\Temp\download_fin.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2916-0-0x00000000751EE000-0x00000000751EF000-memory.dmp
memory/2916-1-0x0000000000710000-0x00000000009BC000-memory.dmp
memory/2916-2-0x0000000005950000-0x0000000005EF6000-memory.dmp
memory/2916-3-0x0000000005480000-0x0000000005512000-memory.dmp
memory/2916-4-0x0000000005400000-0x000000000540A000-memory.dmp
memory/2916-5-0x0000000005520000-0x00000000055BA000-memory.dmp
memory/2916-6-0x00000000751E0000-0x0000000075991000-memory.dmp
memory/2916-7-0x00000000056E0000-0x00000000056FA000-memory.dmp
memory/2916-9-0x0000000005700000-0x00000000057BE000-memory.dmp
memory/2916-10-0x0000000005800000-0x0000000005828000-memory.dmp
memory/2916-11-0x0000000005830000-0x0000000005838000-memory.dmp
memory/2916-12-0x0000000005850000-0x000000000585A000-memory.dmp
memory/2916-22-0x00000000058E0000-0x00000000058EA000-memory.dmp
memory/2916-23-0x00000000088C0000-0x000000000895C000-memory.dmp
memory/2916-24-0x0000000008DE0000-0x0000000008E46000-memory.dmp
memory/2916-25-0x00000000751EE000-0x00000000751EF000-memory.dmp
memory/2916-26-0x00000000751E0000-0x0000000075991000-memory.dmp