c40510d18bc195c3fcfcd108660bea5f30d7ad9302a9c6d4224c045ea5cbd950

Analysis

max time kernel
114s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c40510d18bc195c3fcfcd108660bea5f30d7ad9302a9c6d4224c045ea5cbd950.exe
Size

10.5MB
MD5

45241b964cf644eb0170af23f311d003
SHA1

b86e133e905ed78e1938c835554fdf865dbabf96
SHA256

c40510d18bc195c3fcfcd108660bea5f30d7ad9302a9c6d4224c045ea5cbd950
SHA512

ea2092b0c4f754b97a576c0e80be071c3b50ef7a7fe1238eafa1367d9fdcc59984bcbc607ffc49ea6fd0fd17c7ca66f0e69aad3e14efccde61f0c0214d66b3f4
SSDEEP

196608:CbGrIzeHISSJ7PbDdh0HtQba8z1sjzkAilU4I4:CKrUj5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c40510d18bc195c3fcfcd108660bea5f30d7ad9302a9c6d4224c045ea5cbd950.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
912	c40510d18bc195c3fcfcd108660bea5f30d7ad9302a9c6d4224c045ea5cbd950.exe

C:\Users\Admin\AppData\Local\Temp\c40510d18bc195c3fcfcd108660bea5f30d7ad9302a9c6d4224c045ea5cbd950.exe
"C:\Users\Admin\AppData\Local\Temp\c40510d18bc195c3fcfcd108660bea5f30d7ad9302a9c6d4224c045ea5cbd950.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
0e302284590d1cf3fc3ee9833b7064e0

SHA1
7582e817209c134955db1f48dbc53b5182a1e6a9

SHA256
8642c448ad844569909d3965749e7be1630bfb13eec76bcb7fd0c100a258bd96

SHA512
f7c0957e35e395346bf9678e44f1e08a26065afd74d5e13611b859766e1cfd9e989c6628e5b5406eda15bdd8fa008af5fbc9257ac46273b9155ceba0b4f6445b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
8aa71ebac3de3ba543e9dec871cc454e

SHA1
08ac2e6aff2a4264d2fc4da5c581cdf2c2927bdd

SHA256
0e684cf080721680983555b73e1c799c9a101da99a98423b286b45df473d218c

SHA512
39adb5db79239aab9ea0fe651b03fb8feb40d0b700be8e1132a011bda1b6d972b454257cb5fc45126605914ca47c753f489e8a7d15483b79177857ec60c2cea3

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
31fb04f87a87cc34fd273bf5d6c9d16b

SHA1
6057e2702b0b33e95511156bed31eddc008fc90a

SHA256
8b54070531e35484d894c7f94418a913ec8827544848d609c35c2cb86721e0ea

SHA512
98cdb8e517efe617ac41aa4b0f041ced7dac406c843cf52de3f39af710b77dbef590d2a38094170c47a4d02b4ea4f801ae705b758df45348078d3f1adaf69db7

Download Submit