fcaeb00f9490bd794518090250c59c6dbb7d70a734d4ead4085b051d581c1c90

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcaeb00f9490bd794518090250c59c6dbb7d70a734d4ead4085b051d581c1c90.exe
Size

12.0MB
MD5

3f8244be8149e2abf56ec0c405837273
SHA1

7819ae5f7e6d3b7375a7d8d4bfd387ac626a1a9e
SHA256

fcaeb00f9490bd794518090250c59c6dbb7d70a734d4ead4085b051d581c1c90
SHA512

d955a5199307691ee3b2e69c121af6ea1a3d75f044ec39f037bdd18659b2ed97b09361f0094679fc5338a09a15e509f73fe0d84ff39f4961fb25d854f8307809
SSDEEP

196608:xWwDBSSJ7PbDdh0HtQba8z1sjzkAilU4I4:xWwDB5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcaeb00f9490bd794518090250c59c6dbb7d70a734d4ead4085b051d581c1c90.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	fcaeb00f9490bd794518090250c59c6dbb7d70a734d4ead4085b051d581c1c90.exe

C:\Users\Admin\AppData\Local\Temp\fcaeb00f9490bd794518090250c59c6dbb7d70a734d4ead4085b051d581c1c90.exe
"C:\Users\Admin\AppData\Local\Temp\fcaeb00f9490bd794518090250c59c6dbb7d70a734d4ead4085b051d581c1c90.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
902944495c8f9f7082784aeb77164736

SHA1
be63d2d308a52e83232916386bd626a6f8b3904a

SHA256
d73143273bd42f414c558bbb35912b14146f8968ab3174b25dc02456db738c9d

SHA512
da19c5dfaddb7398e273649391e4a401e7d37476e1da70bf4565aa9b0a02afefe174e3c6db791548376b93ceb859fb36b90ee2c84b292085bccddff09dc2e415

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
23b3ea07a131bcf742c80db8d2f1e5c9

SHA1
3d3f53d1e4d202dd663286a59241118776fa4537

SHA256
ed5e9899a432f08e71540e07499e3bb6d3ea0e9433f3be1446a2127dd9a3d487

SHA512
ab919a8e11ad80e6ab87c7bbc9be25c3d4123d02465b04d989b71dff25b6711126906a3383e23167e87274f393ac2486dab84ac9012686ffe2e9f89475c82738

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
1fc080ae717ea6b3793c1f8d0455a8a5

SHA1
7495bf8b6099115ca31f00380caf44b7fb29acb9

SHA256
172c94cef95114948007bbedcb14caf985a0b5e03124fd328b914d4244e56837

SHA512
31586b9111e48bda458e6ba14d5a8752a8df8ffab23aa38a688968da82ef4c126bd6db00b9f1f384313ebfae160d5876eab4186c7d9bbf71a4329bf090d99059

Download Submit