e9e49f2b993a211c74a71aff025009c2462e7042e50bf19c17d809c7eb8a47b0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

562KB
MD5

a124c92118ef2a46667aaff0de615ffa
SHA1

ad8d41ef91842ce2ed55eb811d60adc756679dbf
SHA256

b4311abc72d0698ce78000c6cffd9d50cc5c7560bcb0e468c4d7e88b71e2c3f6
SHA512

cf05d0df75082d2cf9ca87fb5bf5774ddbb7dd5942b2f053741c16acc908062e144aeb138eab75b7452f42fff5db7533d297b597af6845f1d3535beb0d64844f
SSDEEP

12288:kesJrhOPIvA36E2jk0HI8pJP7/iZ+uASm/oajjKw6PThxlNTz30RheI/5d+ZQKZD:VAhOIA36joSq

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

Launcher.exe

pid process

2564 Launcher.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Launcher.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Launcher.exe

pid	process
2564	Launcher.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
471KB

MD5
d1722674d5d1bca30830b45fdc233dab

SHA1
7b18538ff795457974942d30fe7ef2a65985487f

SHA256
18bb8a4274934707d306e19c17fabebcfe0fc48ff6d6949f6fbf65da17f56d5d

SHA512
27a3fea95f752a4aa3ac6e22047e4ab7617cde72083634931ad2286f686c382b5f0de7f8785adc3517d3bfe734dd36c94d7ca4176f8fd2302e459450aaa347e6

Download Submit
memory/2564-0-0x0000000073D6E000-0x0000000073D6F000-memory.dmp

Filesize
4KB

Download
memory/2564-1-0x00000000000C0000-0x0000000000152000-memory.dmp

Filesize
584KB

Download
memory/2564-6-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download