6ab527756a7cc2b9a261d02a1fe595a37bb55b545e1980b67da007fb81a5e620

Resubmissions

26/07/2024, 15:25

240726-stlfrszbrc 7

26/07/2024, 15:24

240726-ss6qbazbng 7

26/07/2024, 15:18

240726-sp1pwswarj 7

Analysis

max time kernel
6s
max time network
11s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hl2build99.exe
Size

16.9MB
MD5

cabc41ba47360112d680da6f14436e78
SHA1

c203cbeabc4502f29ac85004a65f8b1020de3ae1
SHA256

6ab527756a7cc2b9a261d02a1fe595a37bb55b545e1980b67da007fb81a5e620
SHA512

6da1f0d2dd0ac952ec4fcdd2769b14b9eb9477a3bc7dc3938daa1ac6fdf71ff501f474cb3d77e97314454c5c7967e61d2256879bf0b92337ae3b9a5a0a60515c
SSDEEP

393216:XVm32pIsJDnXuyCdTsOuGSKAUUOeNL4NMuu2DGY3vIIHBq:0G6sJDnXufTwaAUUOWcMN+GcIIHBq

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2852	hl2build99.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl2build99.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	hl2build99.exe
2852	hl2build99.exe

C:\Users\Admin\AppData\Local\Temp\hl2build99.exe
"C:\Users\Admin\AppData\Local\Temp\hl2build99.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gm_ttt_99058\D3DX8.dll

Filesize
484KB

MD5
74529599302a2e09c30b1e119a0709f2

SHA1
5990f60194ecafaf43340e44657d224f8d5682eb

SHA256
edfc5f86be36c2c509e4ad6ba3742bb5b2429a56de805a99771e24fec62b076a

SHA512
25d1c2bc15f5d20f3d69a2c20727e4e2cbb7086aa18ec535eea2a5766302b031c12b9139467b717537300e1497102b387dcc3f53ca5ff11f5301de672efe4b07

Download Submit
memory/2852-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2852-5-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download