c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 20:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63.exe
Size

9.8MB
MD5

15b52d93049b62848435292d26da098e
SHA1

7bcd8106ee2263d4a9a37c5bbefdec06a7df4ab3
SHA256

c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63
SHA512

b77b5525ef505a0667b4a742c59aa1583709b79669eaa62d46da3eabdc92589615c63c1ca0a707b78f67a46855d54a5471494c9dd5e10345025a04c2b63da12d
SSDEEP

98304:3bl/9COfOItynzWQQMIHp7w0rbDdQwNSH6uE2Tp2mqSd18z17wF9vVGyWWyfJprG:3LSSJ7PbDdh0HtQba8z1sjzkAilU4I4

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2888	c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63.exe
2888	c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2888	c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63.exe

C:\Users\Admin\AppData\Local\Temp\c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63.exe
"C:\Users\Admin\AppData\Local\Temp\c683577c03c1396c939122f1b80866fe6b5cc4e1632df8b57bb5298d03bc9a63.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
76f7eb3e9d6e9cd1c6f83a41a590b090

SHA1
35c04ac35453e78a004e299ca55e70b1cab87873

SHA256
a5b8a02c7da51f363f2a7fad001ef865eab177514d991267ff6f9a07ecfbe113

SHA512
c29ad707daab02ee555cdd00226915037a51cc89d55d68086a839a92ee5b76d144d4b5933b9cf70ede362aae9fb2d8c02c2634248e93e6bbb2c105d216dd6cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
4cfa4b3dd19b145e38617708be2b32bb

SHA1
0e4f18eb8e1aea60dca221e21dc6ee6626e5232e

SHA256
3882ff9e055528fd02f139ccd4c48743544b0665281cfbd913b356cfeb108a10

SHA512
290df0fbee815efa19021f98023df56a3f44a4a404c852a16e105c5f64baeb62b6afd8d0851ba42695303a0ccaac2cc3c5e1561f8cee0284fe51d0b9f94eee9d

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
2c5e0c50cae78340c5f1653d4d5b3f98

SHA1
d9428e323678e0133e61fc1f879fab97706c63b5

SHA256
b459aa2fbfa2ecedbf349def4c942ee5c60768d281509024b1e4c7e8a9dddc6d

SHA512
e4505727378b809b20be82fff6427749f332587a9c4d261280e9033980ed337be22cbf94f5c9dba475731343905af63e0e3c0fc02f36856009da43bcf48aeb26

Download Submit