b8e17a056a07325b51a9bb9f1e0c0c8e5560830aab9a0fb6e319b36c29611a24

Analysis

max time kernel
130s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8e17a056a07325b51a9bb9f1e0c0c8e5560830aab9a0fb6e319b36c29611a24.exe
Size

48KB
MD5

6ce197524eb53f0dcaafe3cace77e539
SHA1

7863e17261c1ce6db7237682f72468cb9f6953e0
SHA256

b8e17a056a07325b51a9bb9f1e0c0c8e5560830aab9a0fb6e319b36c29611a24
SHA512

948ef1ae80feaf1510e5f6f0f8f7f11c62dad130d55db19af23b3ba02802cc325fd93a42308590d359d2912c50cf5dfa8019f6b3eefb6312094adb3c49c84777
SSDEEP

768:9GvbqsQdX5BhGEnOsIzfJ4i4g5p0syi+hvN18K3H8T6++3Kd8VVrGN:4zqsQ5PIt4+/yfeB6rXVrGN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8e17a056a07325b51a9bb9f1e0c0c8e5560830aab9a0fb6e319b36c29611a24.exe

C:\Users\Admin\AppData\Local\Temp\b8e17a056a07325b51a9bb9f1e0c0c8e5560830aab9a0fb6e319b36c29611a24.exe
"C:\Users\Admin\AppData\Local\Temp\b8e17a056a07325b51a9bb9f1e0c0c8e5560830aab9a0fb6e319b36c29611a24.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\The Thing Full Downloader.exe

Filesize
48KB

MD5
87c833bbd9ba4cee330cd72301d806e4

SHA1
a399f12dfb19aacbba9a31eb12746ce378b931be

SHA256
f91d65101d08925353a6525300399ed1d210839d6e64c424f8a7aff3810db70d

SHA512
c71c2625914a8742df6b72a0c2a11f012337f39475b4c01bdd568cc27921ea9f6f6f3f6bfc60fbbe3cf9ef4e3f3981a39fda94f4384195b957c07fd6ff4b1bfe

Download Submit
memory/5072-100-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download