343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe
Size

3.1MB
MD5

3fdbe3a6d28a240f751f9966d8912455
SHA1

87f6f3cf7837134e5d09cf3f5c96f4a836ff6051
SHA256

343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7
SHA512

35efeb22dfb0d12e0268a3a9ce5ff09c052dae1d6cda9dd7224a10e87e1c9c342b7dd4e0771e4d7b8aad8cf8b35f22a71c50742a4946cc0f94e5e38329795f3c
SSDEEP

49152:pQH0mOzsgaN1Jgoxx2jqLpdJ8LgqpjILJg/2obq0OEQ1fN3VBRTy:uH0jzsgaN3goxEspdJipIddobqWQNnK

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3612	343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe
3612	343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe
3612	343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3612	343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe
3612	343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe

C:\Users\Admin\AppData\Local\Temp\343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe
"C:\Users\Admin\AppData\Local\Temp\343a53a482c8a802ae578955a2988b196a1297c3b1711cdfa6e2371c6d35e8f7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HPSocket4C.dll

Filesize
2.1MB

MD5
04869ada712c189caba4822be0e81ea5

SHA1
9c45486b30e6d3ccf0737c5766796baaf58232ab

SHA256
23078015adb0cf53ebf632a895a1a224b3718174e6c2887e1bbb2d28be5e2b8b

SHA512
16f98af15583c60da0cb947ea2230f759bfa27f86ef93ef5f7ffe2adcec6c5f115f52ffa74bae6cf8add94bb6a380fa276f391619256be7a45c53bb7421fdd9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\iext1.fnr.bbs.125.la

Filesize
728KB

MD5
006d175e480403666095f4077a7b4260

SHA1
8a13d09ab170fd3e04edba33c16f6a91d91fce82

SHA256
0af365b5db119b2f43d72cb75f3f0302bbaa3a05ef61ef71c256c231713be5dd

SHA512
5a31a7a8e147752982075b76c6e64edec28c245255f8f0cf3d1ad76436619a32b448c19194a4e74bed92fb1f65da59dbc8383e004755d42830fc68de63b702c6

Download Submit