bedde66e3b82a22c75c4fe7c5e60396ba4a0a53e95a332c2aa8851c0068f787b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bedde66e3b82a22c75c4fe7c5e60396ba4a0a53e95a332c2aa8851c0068f787b.exe
Size

10.9MB
MD5

236623822a0a39f296fb10d01d93f1d2
SHA1

8cf19183c4f3529dcc2d12e235f467b1f8d343f1
SHA256

bedde66e3b82a22c75c4fe7c5e60396ba4a0a53e95a332c2aa8851c0068f787b
SHA512

f4f28f1f3797a83c19eaf3acf9b8e1fa0d804248ed0d1987a50407543ceac2d170afb35246dbbc529267a8a3d6babce6b15d4120047465b6d1e2545a88b20de5
SSDEEP

196608:ubGnWW5WySSJ7PbDdh0HtQba8z1sjzkAilU4I4:uKnW6Wy5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bedde66e3b82a22c75c4fe7c5e60396ba4a0a53e95a332c2aa8851c0068f787b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4152	bedde66e3b82a22c75c4fe7c5e60396ba4a0a53e95a332c2aa8851c0068f787b.exe

C:\Users\Admin\AppData\Local\Temp\bedde66e3b82a22c75c4fe7c5e60396ba4a0a53e95a332c2aa8851c0068f787b.exe
"C:\Users\Admin\AppData\Local\Temp\bedde66e3b82a22c75c4fe7c5e60396ba4a0a53e95a332c2aa8851c0068f787b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
8KB

MD5
974a1453c3ed5c7792864e8b421b06be

SHA1
3880214c0de299e540bda06799818fbe59c38aaa

SHA256
d69bb294a31c3f8c0dc253a9e6c2ead37aecc542b3fd57df1e804c3b317e9c11

SHA512
6044eeafb54ca010e4917981add48b9d8f595e322b6ff96eeadde3f4a62ebe497a6e57b4f206c837aabdba26c4a83c168df5e6d3d0c00691ef052d269b8030e8

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
bc33410b8e5fdb105632cfffca01d154

SHA1
dd6e8be36b91aeeff18f2f6e2743669ee71ce6c5

SHA256
012384cce2775c96f51ac99afee3b9bc892a89e87529959f4069908cef6242a2

SHA512
b249b06338607539785f56a7ed31b7d9945c6404b65e3109aea06f0eb8d8a65916f896f6cc1acee62af39ad9e49742bb6dffb0f4d6d00c17e7236072cd08632d

Download Submit