7488c30d27494bab671e3adb61eedffba736eb0cbafcccc7c6275bb8eefaba71

Analysis

max time kernel
110s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

674cc26d0636815aee9b98603d56b670N.exe
Size

139KB
MD5

674cc26d0636815aee9b98603d56b670
SHA1

ee869464ede56331bce6f73552387f23a5f40430
SHA256

7488c30d27494bab671e3adb61eedffba736eb0cbafcccc7c6275bb8eefaba71
SHA512

679f1948c797383a61ddef39659a536eedee4817a47217af07cb6201cc51e4c9d44e1e366f98a48bffbd6b1be222a72c1485ce5bcf86b31774aa34b9362a3ce9
SSDEEP

3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/w/Fnncr5:hDeM7iNEkgiOb31k1ECOJq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	674cc26d0636815aee9b98603d56b670N.exe

C:\Users\Admin\AppData\Local\Temp\674cc26d0636815aee9b98603d56b670N.exe
"C:\Users\Admin\AppData\Local\Temp\674cc26d0636815aee9b98603d56b670N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-hFPH3ScubOr1eyXT.exe

Filesize
139KB

MD5
88ffd686695a84863fcf516d8a804064

SHA1
372308292ab13a929af7773e72ca5a6abbcb3b25

SHA256
653ec43a97fe70d181bb51c7240fb8b84cd0a9b06128241a887f9a0949ed738e

SHA512
0062fcc0cefd185c3f6ab6d55afe55424094a24be38ff5d104a068abfc2a14beb3e7c53e43e9513397035c05515c5ba092deb62082214e8665bf495cfe9af0d3

Download Submit
memory/3704-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3704-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3704-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3704-17-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3704-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download