10949c5054baed3b6f652bb44ca1cd6474ca0e8c5a2ef21fde3beb7445562de2

Analysis

max time kernel
121s
max time network
155s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10949c5054baed3b6f652bb44ca1cd6474ca0e8c5a2ef21fde3beb7445562de2.exe
Size

10.9MB
MD5

32db6f0229986d136a3a968201579466
SHA1

f92d268c24cc3a9b2b29beddee261122896b14a8
SHA256

10949c5054baed3b6f652bb44ca1cd6474ca0e8c5a2ef21fde3beb7445562de2
SHA512

36dcda2af2a88cfc3a89aefe149962bac29e6162ff1506af262b8b4021e8bf394cdf1b3a16286f7542e78e310870c46687d12327ce5eb8897b97205ecffb7433
SSDEEP

196608:ubGnWW5WySSJ7PbDdh0HtQba8z1sjzkAilU4I4:uKnW6Wy5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10949c5054baed3b6f652bb44ca1cd6474ca0e8c5a2ef21fde3beb7445562de2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2488	10949c5054baed3b6f652bb44ca1cd6474ca0e8c5a2ef21fde3beb7445562de2.exe

C:\Users\Admin\AppData\Local\Temp\10949c5054baed3b6f652bb44ca1cd6474ca0e8c5a2ef21fde3beb7445562de2.exe
"C:\Users\Admin\AppData\Local\Temp\10949c5054baed3b6f652bb44ca1cd6474ca0e8c5a2ef21fde3beb7445562de2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
b5109a16d52d5761997a3bf35f2161d4

SHA1
1698365e65580963c589af033cb462d593948528

SHA256
bba08accf5cb93a6d50c9f8b0703606a54429ebffd496d577921947a5f75efc5

SHA512
04e1eb9ac833d274747a4767a707f5c2841e0719bacc67bf46820718ed5222bca212214eb09adf8682374e53987032882714001bce757675c432d99c9e38d880

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
a0e253a3cf0f934efd667d78d99f2c1e

SHA1
172000cb77867835a574529d34f1db0c17473cf6

SHA256
7652f8408062a961618e3c9679d8b01423ee6d8530c4ad021f7c56338d7f3e9d

SHA512
cc66b81b6c3f7b304bb8fd70c4271a63bf99a11bfcbc9fb909312cee32c9a6ace0e220f4e2a5babac3bc858603d7db5a39234fc5a5a2f874ad814c3381f06306

Download Submit