d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c

Analysis

max time kernel
48s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c.exe
Size

9.6MB
MD5

cf14adefa8e056f1cb6b2b8b69a89d2d
SHA1

2ad69a2c7159ff69f293abadbf72eadbada37c64
SHA256

d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c
SHA512

06e4c8d9c5155e8741a9ddb232b15760f1b5f5ad3d2fedebcf2f069e5e6127dd80054508bf4a3db98f313939b29a8041d568fcd7a6ba50189bdd64ca4fde8858
SSDEEP

98304:9UbzNQaG3GynzWQQMIHp7w0rbDdQwNSH6uE2Tp2mqSd18z17wF9vVGyWWyfJpr8B:kvSSJ7PbDdh0HtQba8z1sjzkAilU4I4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1712	d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c.exe
1712	d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c.exe

C:\Users\Admin\AppData\Local\Temp\d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c.exe
"C:\Users\Admin\AppData\Local\Temp\d2ced45a8eb7cea8b2044099a1eb3a4bbb0a093dd1118a85c7e964d3812db24c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
9d2595135fa68d709c7d7f6537651ce7

SHA1
616d1e08040da47e9e627842e4fc682ee79987e7

SHA256
b641b04d4557be4a57779297bfd300f9f25f2ee4b6d14c67f63eed8c958d791c

SHA512
5ac36f995ddbf434cfc1ec6ac8cbf5f2fe211c5f03173ce47fce35a8e0e5eb879b693b23ac9531479d599bc8c433bf347e0bd982de711860249c0fd64239ecf7

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
f0973cae9ad89dcebaab9ecae9111978

SHA1
70833633079bb161c27651d503f7ce17c617b2f8

SHA256
b57d87d0aeb87cc79cbd65f861f0f870d2024a39c4165f5f510c7ba9f4673430

SHA512
46c22130679e0f1c353875fd6feca82db0a0e9ba351249f25bdc6ebc6d82bc5e5bb1ef9eaaecc419000cea0d69965fc5677360a0a949aaef005e3b5f52853f08

Download Submit