Analysis
- max time kernel
97s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
18/06/2025, 02:34
General
- Target 0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
- Size 355KB
- Sample250618-c2yhasgp8v
- SHA256 0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 16162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 5928 -ip 59281⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5928-0-0x00000000753BE000-0x00000000753BF000-memory.dmp
memory/5928-1-0x00000000005E0000-0x0000000000640000-memory.dmp
memory/5928-2-0x0000000005540000-0x0000000005AE4000-memory.dmp
memory/5928-3-0x0000000005030000-0x00000000050C2000-memory.dmp
memory/5928-4-0x00000000051C0000-0x00000000051CA000-memory.dmp
memory/5928-5-0x00000000753B0000-0x0000000075B60000-memory.dmp
memory/5928-6-0x0000000007DF0000-0x000000000831C000-memory.dmp
memory/5928-7-0x00000000063F0000-0x000000000640C000-memory.dmp
memory/5928-8-0x00000000753BE000-0x00000000753BF000-memory.dmp
memory/5928-9-0x00000000753B0000-0x0000000075B60000-memory.dmp
memory/5928-10-0x0000000007BC0000-0x0000000007C0C000-memory.dmp
memory/5928-11-0x0000000007CB0000-0x0000000007D4C000-memory.dmp
memory/5928-12-0x00000000753B0000-0x0000000075B60000-memory.dmp