6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3.exe
Size

10.4MB
MD5

93b28a8083b9e990eb5bad1e09565dde
SHA1

370e73e6cd8435c51e5b17eac62812ae335d691f
SHA256

6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3
SHA512

e4ea1c74dd5060d91ad9df5943206e39880aa09b52b31aa6c185a14b4d8ff1eab556a0b7dad6dfd0da6172fec12a30bc084593ccd7c08efce4742baa2a147ab0
SSDEEP

196608:t7+K5IjSSJ7PbDdh0HtQba8z1sjzkAilU4I4:t7+rj5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1708	6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3.exe
1708	6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3.exe

C:\Users\Admin\AppData\Local\Temp\6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3.exe
"C:\Users\Admin\AppData\Local\Temp\6a6bea9b572c00ea1e06435f0029ec6f08a89bb29283a59c119d91b5ac62a1d3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
26405cf6eda6fa1dfcc946f960cd0c72

SHA1
6e53d0bbb4d5ea391e2af07d1e402498bad667df

SHA256
383527417d729bae9038a5de5fd6ab5129f6f8feb382829f3110310e885d72c2

SHA512
65f3971db87dadca43e56f8be53b224da1e1202be8aa2c760abe1b7a77a4b0d540275c679aff33156117f9b44a4df9f5518ae0d872f7c0f09767576c2b7d9b80

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
532ed58dedad1e51b06f44378025e4b5

SHA1
d32e0dd55f7630f59748a4583c5edee906df7ffe

SHA256
e2d71e8bf19c1973230a61595bffa229b0138be7c544dfc7ccf4c813688cd591

SHA512
373080216c8d3777ec3ab3164e8195778ad4dee82d77edbfac50dd677728a461db5cad4250af172757868b724c1aeeed024fa5afccb6a17d51f050b1a1ec9b03

Download Submit