425c76f8260e694f3cd52a2ea0011923fc268e2514f8798c5b2a9767e5d2b758

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

425c76f8260e694f3cd52a2ea0011923fc268e2514f8798c5b2a9767e5d2b758.exe
Size

941KB
MD5

ee221f63030d0253bbb0e050dbc31bd8
SHA1

9fabc8cc475470e6192ad7f8fca2b34d2a5d840f
SHA256

425c76f8260e694f3cd52a2ea0011923fc268e2514f8798c5b2a9767e5d2b758
SHA512

5ede7458ee795bc7e23606617a9a63490e3b8b41c8c2e8a29ac378386b16c6dd4247e8031043baa8ca23045ba651f7bcff394c85d9280d3bac9b09cb483a47ba
SSDEEP

24576:WAHnh+eWsN3skA4RV1Hom2KXMmHaKyPgR+6RnA5:xh+ZkldoPK8YaKyPgg6RG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	425c76f8260e694f3cd52a2ea0011923fc268e2514f8798c5b2a9767e5d2b758.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	425c76f8260e694f3cd52a2ea0011923fc268e2514f8798c5b2a9767e5d2b758.exe

C:\Users\Admin\AppData\Local\Temp\425c76f8260e694f3cd52a2ea0011923fc268e2514f8798c5b2a9767e5d2b758.exe
"C:\Users\Admin\AppData\Local\Temp\425c76f8260e694f3cd52a2ea0011923fc268e2514f8798c5b2a9767e5d2b758.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Aiden\Logs\Aiden AidenBot 5.2.1.0.log

Filesize
1KB

MD5
dc2627549daf0c1dfd32f65f8718c3f0

SHA1
be3ac5e2552de5fbe5c2c30ef5e2f71ecf1d0d3b

SHA256
50ef892888c227c1359eb6d8b650705877c55b612c2e42e37c384d0fbc1b3eb4

SHA512
e22c715b361a3a2a287a8f060fb35d066ff81718ab59af5cbbf227475ff7fee82f22d696be10735bf6c5c9d4bf8d260d1b3c4dfb15a5dbd7d0da9165a71f481e

Download Submit
C:\ProgramData\Aiden\Logs\Aiden AidenBot 5.2.1.0.log

Filesize
470B

MD5
9cb2dfa843cfd8f985ceae28c3663752

SHA1
74f33b0ce8e351ac601f06e8f11ecd45350f3c69

SHA256
801209a21623e44c57478ff16e0fc970200ec3cb83cb78976d99b1a1786bacf2

SHA512
d72a17bd295dafa1b5d75104a6ced7d2de13ac1b8c446401d33fc7eb31374f8621e94b12701156c992481a4f22a8ac9f7fd5519b315767a71ed8ec4437e8b97b

Download Submit