16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1.exe
Size

10.9MB
MD5

8d194659554ca4e1ec6fe19e7e5690f0
SHA1

e84b2e403fb418af9f07149647a9cba56bd65ab2
SHA256

16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1
SHA512

47b4dfff550db759f0a3bc5a2a3231aab94c9599dd58db8ef62a2c2a00dd310a38e298816e34156bf083be7eca1a429138f2c5471f51be82259e26c816c0d2af
SSDEEP

196608:ubGnWW5WySSJ7PbDdh0HtQba8z1sjzkAilU4I4:uKnW6Wy5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2120	16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1.exe
2120	16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2120	16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1.exe

C:\Users\Admin\AppData\Local\Temp\16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1.exe
"C:\Users\Admin\AppData\Local\Temp\16b26cc8e7311d9680f01774f7fa6294ad2010cc58a62e8693125d4371c086d1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
f60e6ec89cf36b1eacc634199a2717f4

SHA1
5aef4f686a3625191848f323b870fd36e5e80bc4

SHA256
62e3a255819b5c3cdc114560ee235a731adcce623606bc2883a0673eb03edcf4

SHA512
c55241d01d248a7781b49fdbdabc981b660c1e94bb0fd2b8b826d7649fffc7cda80efca28ef9fae77c9f1583241fc3a267b09bf1239848b58d7605ea4e189b94

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
c9e1d16ee0fa225ec7a4f9825404eebf

SHA1
09a51738996d2712ea401003d468da1fc7a396a5

SHA256
ce012d014c4e9dbd34c9d43b5f0d75630b9eacdb4630a825a941e27b68a209f0

SHA512
fd71c7c8122eb2d0a3cb06cb30885f7472a7696a197f693308fc2e27c67fd923bdfe1e5d9d875660a8049f69fa6c84bd5147e8d4331573f0a339d174cec28d45

Download Submit