fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0

Analysis

max time kernel
55s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0.exe
Size

10.9MB
MD5

74d8e2de9595d96827de1bb4766975a0
SHA1

9b67014e1a8c9064f864ec32fa242ca94b4b27f8
SHA256

fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0
SHA512

a338a09e1d4b2beb77965bebaef6027543a5d125cc568ec149203f2400a81a2570d53cc315cf799cc03f79b7f5aa91135cef209c28b5fb91a010de873be3eed5
SSDEEP

196608:ubGnWW5WySSJ7PbDdh0HtQba8z1sjzkAilU4I4:uKnW6Wy5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2524	fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0.exe
2524	fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2524	fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0.exe

C:\Users\Admin\AppData\Local\Temp\fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0.exe
"C:\Users\Admin\AppData\Local\Temp\fe9496a9d2cc8a79d879fc6251753dc27004a0601482b26a6924d97a4de230e0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
37110644de8d9eaccc2bfa800c7d0bbe

SHA1
f92bf5e7cf37f6e70fb23b13e377e29d282f5dba

SHA256
fe6a74fd37d0fb39a8043ecfa9f5ecce6a7c06a0ff2c695fb73731f59bf34124

SHA512
1365d81143a1a93122c841b4803d2df2722d4320eb01c523a9108b1594564ad79e83d62d0b41618ee11c4f5741eac95f28a901b910fe895b81d731ad6955bf28

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
df8890b3501a37e8d712a26e8171e657

SHA1
fe589eb4c28f409c09695bb5277ebc97157c49f0

SHA256
35395ac941582f54a58e04e6beca3e0e20b32e1e1c1a04c2b98ed465f98f877c

SHA512
6572b14ddd5980ded5ef46fe99cc9451d04a547c06be93db1dc92315aafb479dffdc1d50b34fbec3efd9207320cf2acc7eb90c2b203558ecffe7fa0d46e778e9

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
cf4d0e141d635a2a293613abb80ec0ff

SHA1
9562c35f11a6d7634595fd2b763e9b8be1152f37

SHA256
94ce888382724913ec1b25cdbf56eb10aa4ff7471f6345e6eb95b01d90d6ee44

SHA512
d75d531d7603264127d4b5fb9569664bae5d9cd9ce334d08f8882997d9e1cc5b582e8473ee18246244e9491b5e11fbad155fee21649f28a0503516f07aa8d15d

Download Submit