Overview
overview
3Static
static
3LoveString...ng.exe
windows7-x64
3LoveString...ng.exe
windows10-2004-x64
3LoveString...ok.dll
windows7-x64
3LoveString...ok.dll
windows10-2004-x64
3LoveString...ng.exe
windows7-x64
3LoveString...ng.exe
windows10-2004-x64
3LoveString...ok.dll
windows7-x64
3LoveString...ok.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 14:52
Static task
static1
Behavioral task
behavioral1
Sample
LoveString/ANSI_1.85/LoveString.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
LoveString/ANSI_1.85/LoveString.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
LoveString/ANSI_1.85/winhook.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
LoveString/ANSI_1.85/winhook.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
LoveString/UNICODE_2.00/LoveString.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
LoveString/UNICODE_2.00/LoveString.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
LoveString/UNICODE_2.00/winhook.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
LoveString/UNICODE_2.00/winhook.dll
Resource
win10v2004-20240802-en
General
-
Target
LoveString/UNICODE_2.00/LoveString.exe
-
Size
122KB
-
MD5
cb07d2494576833dc83451b99e1b779e
-
SHA1
5eeda06d991ca82539da65635b0efddd8c05b2a7
-
SHA256
e12ad108e231171007aadb46c4e0586c8093b0adc46ce12d65739b8e367da0a7
-
SHA512
0b486e5f922995d241cdebd7995d03b5e42f0e05542f6f535f67e109d1b884529dd45b6f2022fcc2363c24cce0baabfd8e070c9d406e69f784cb62dbc731725c
-
SSDEEP
1536:V2c0cCJ0sy4didT4qVqXlr1rN5JWAk3e9pU60EsrQa1ptnSkb4PNiJ/ptnz6WU0K:kdPIdsRiipUmGpiiJpJRU0L
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LoveString.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1700 LoveString.exe 1700 LoveString.exe 1700 LoveString.exe