Analysis

  • max time kernel
    103s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 18:04

General

  • Target

    $PROGRAMFILES/WebEdit/webedit_run.exe

  • Size

    116KB

  • MD5

    3ecd8cf00f91b91c963976b9bc63cf76

  • SHA1

    ab6c0c285f2ed0d58e3528b995bef710af2cd6ca

  • SHA256

    8f685def2789528b90dcc4d6f011f471df237f5729db1b771f8c04a579824dcb

  • SHA512

    d731e26fa30cc9b6e96746baca19d916db4e589dfc5f10435cd6f10051623e2e39f1e37ea8de193e4ab9e749e83079f9f7927653668a4e28f0bf64dc5a1c0d57

  • SSDEEP

    1536:Z4OjnnLDiKQqCmd49J2uSF0/cyqsMYdLY3wnD3Y0nmsB:Z4OTLDLovB/cyqsMYoy3Y0nR

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\WebEdit\webedit_run.exe
    "C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\WebEdit\webedit_run.exe"
    1⤵
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5044

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads