48d22538afd99dafd7dddbb1720ce8685df736b7f1542b90b32a0ee784a4dc40

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-08-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48d22538afd99dafd7dddbb1720ce8685df736b7f1542b90b32a0ee784a4dc40.exe
Size

2.6MB
MD5

87c579c3b1b0ebaf0d1c2963ccd725d6
SHA1

38428821831cc81c41f8a97cd071833308b1dd58
SHA256

48d22538afd99dafd7dddbb1720ce8685df736b7f1542b90b32a0ee784a4dc40
SHA512

3c2a0c7a2999dc01ee6dfb067942566b0268ffe2674de6a673baded2e0e0714fe03f7d80ec25587f16ad1258983bd245258cbbedb54e840eaba8339b1107da78
SSDEEP

24576:TucBwZD8DBdnCHAaYHL4K1IlphKFatA8M2uWyu9IPCFIfF8htf1uHqkLtmWuKGjH:TukDrH0KttIsqvUHr2tjUiPoPDk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48d22538afd99dafd7dddbb1720ce8685df736b7f1542b90b32a0ee784a4dc40.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3924	48d22538afd99dafd7dddbb1720ce8685df736b7f1542b90b32a0ee784a4dc40.exe

C:\Users\Admin\AppData\Local\Temp\48d22538afd99dafd7dddbb1720ce8685df736b7f1542b90b32a0ee784a4dc40.exe
"C:\Users\Admin\AppData\Local\Temp\48d22538afd99dafd7dddbb1720ce8685df736b7f1542b90b32a0ee784a4dc40.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-0-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3924-2-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3924-1-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download