408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13.exe
Size

9.9MB
MD5

1139f8000a868574a761693f22498e3f
SHA1

1abe2c9a2469339fea25ca59d2a420d2d333aaf0
SHA256

408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13
SHA512

c85a2566a3beef15b96f3ff6569296b55936ced875072d6015b3671294cac0d7c19475729320f33f13d232facaaa1e73114714978c8c31ddb611506b83554959
SSDEEP

196608:PbGbSSJ7PbDdh0HtQba8z1sjzkAilU4I4:PKb5J7PbDjOQba8psjzyz

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3032	408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13.exe
3032	408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13.exe

C:\Users\Admin\AppData\Local\Temp\408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13.exe
"C:\Users\Admin\AppData\Local\Temp\408c838da08fa337c0342cd4b4650cef9c8f025f1ee17ceb976d8b03e9f46b13.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
13KB

MD5
bff6c63a4d9406c96f23087fdef45ac1

SHA1
0e1492ab948653a8f8ed932cec880fa438b4c79e

SHA256
0ff2e2774c23960a33d26d9e81373db7c4148172d9e7dc707979d054d9fccecf

SHA512
d246b7a80f41dd8b045e0943fc5eddb5eb5dce6e16467c34c8f08283b4353919c8dae5abacbb7763bcba075109dc356597965a44f797af9b57b2f1bdeab4cf06

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
207b24bf66568176313cc252f806647c

SHA1
f382b20be9c31fba5f7fe8ab53ab02524ab679bc

SHA256
bf25f42573b7283d9450b8a6577f7ece4056094a37803786768f88f65e87beb0

SHA512
bf3613fbd29b7e040a9e1247c131bbd40b42cd662e6cc9786fed1f36bae081b7f963a9a9e197baf7ac92dca69251f76bdfbd2c60acd4d54d3bb5978f10e623a6

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
ee03bec85dd157cf9631df09946df6a9

SHA1
43c1851d1b6874e6b76c846040da52c2b48abcf1

SHA256
bcb65d6e88a9e525e4403e11c97d566b58c5741a5a6f8273b52cacb6a67c768e

SHA512
97e510418367add315c57db7f9538fc80ae0426b1ad343b79cd42bf0160978f99a6eefc4d1bd466a51bc1f488dc8d027b9fb8e10474af537b7a078d9bc670f48

Download Submit