ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6.exe
Size

10.4MB
MD5

e4168ccd62106e8488501b365bc1d520
SHA1

6ebc9692fcd4d79de4a153aa88b46085fd0310ce
SHA256

ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6
SHA512

1f16638d798266f2a2d2dd041fc6ed25b8dc0a6e7756bdd3a8b0a6a936145af6a08784074ddb31bfa890d9be685f6987d1445b4b6d53727f9be7c8e2b9b931ed
SSDEEP

196608:t7+K5IjSSJ7PbDdh0HtQba8z1sjzkAilU4I4:t7+rj5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2564	ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6.exe
2564	ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6.exe

C:\Users\Admin\AppData\Local\Temp\ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6.exe
"C:\Users\Admin\AppData\Local\Temp\ea66f6dc2717beecb89ed689049b83614333a22116f330c45da3e6747d59b9a6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
d2996fba87806b54432b9ba486f93caa

SHA1
0b9167d2acae1335c9de34e705b4d51425a7373b

SHA256
fd87fb0c4e9c7daa165952bf4ba3eac8c486b3d6a654321b530bd1cad98f9e6f

SHA512
bc0638b04b1dbe2a2883f003fe37c18b7e18591498ccfd42957ccfbe0aad70eb8628368c2e5c620f25519f26b5b1f0510c8d3626826c40254fd99031a4d45809

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
74bedfe1c0f3ce3a9b071b569c4186fb

SHA1
4c4af393c35f642de4eacc1d3b53dbad82f1e28a

SHA256
e8e448d1e8132e53543a4e6350d937e2870ef5163f57dddd3d3cd767e72f1d60

SHA512
13b7a996774059f4a23022ba3d8b9ea4e3729ae1cbf5901a58761ac496d730f73f74f51212ee3346aef4f0c4e317ea4b974a7a9cbac012f86f4ae5f698c2f8f7

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
8a4ca6e117d5071b576b7d3388e0b2a2

SHA1
17309cf0edb66fbcbd95747d1be4f42d61d6e859

SHA256
c0dbf92b61de2cc9650581b4ea4abe7a993014b898cdfff6d5110034036aea35

SHA512
749aba20ac158a6576e7fb3185fbbf7abd480a4b69a8e358146199f4548836fb278125ed062a3100c0b937609a4ec4d27ed1d2b20df11e26dc7bab6d24fb492f

Download Submit