c8a469f3405b3ba62d4251f863e04f810d475aca7e56d2c4db7aff2e1d87b805

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RCleanT.exe
Size

212KB
MD5

36528e21bf54bdc6ae0984b64564fe78
SHA1

d16f64665cd14e94f65c600323aded6d8f6af8c3
SHA256

ae5cc49ee175ad01f9a3e88bbae40bed36db1d6c1a29f60df5ec2905205fa30f
SHA512

c1ec229d41da11a6e5be82924642d86555fd81e7e1a5b4955e6e9468c06859ae8a666d884625f18c7ee69c9ab22bd16ac28c757d0db0e00591ad4a2cd1ff0f02
SSDEEP

1536:OqxuvsXVZcp74Q2KgULP960Vs/oazNvli:OqxtVZcWQLJ960Vda9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RCleanT.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	RCleanT.exe
2368	RCleanT.exe

C:\Users\Admin\AppData\Local\Temp\RCleanT.exe
"C:\Users\Admin\AppData\Local\Temp\RCleanT.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads