9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe
Size

10.8MB
MD5

28e2f9388087d25ab73c757995eeb210
SHA1

4580981f2f3e83bf1461b66e59e9709637425894
SHA256

9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed
SHA512

1665c3a19ba1527732860e1c1bae1d158aed035c75ae7638bad6369cb8d92c2595620b4b087dd3ba62cc7f0b53ef25b3b37ae4f4c5f830807d71efb4577d691d
SSDEEP

196608:ylWW9DrFSSJ7PbDdh0HtQba8z1sjzkAilU4I4:ylWO5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1596	9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe
1596	9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe

C:\Users\Admin\AppData\Local\Temp\9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe
"C:\Users\Admin\AppData\Local\Temp\9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
7ed3f2c35532c46e6af756850c0e3983

SHA1
63973df61d0c065fbbb20c74f321a9edcbf08c18

SHA256
2cfc64c906ab356d65918444f6bbcab3920b21c91ce00d1d0d370dabe2c395cd

SHA512
388148e366a2a8bbdc14ff534126ee7bd49e4c222cb71157d19746547fd0208cb0d0db4e05289ba6ecfab7c89d278ba4735a933cb27e198e9d2b1af247967cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
baff449b7daf536e0ae4a8274353209b

SHA1
0402076a951353e6600b7a0897b4c720eb4027a3

SHA256
db2305c939dbe42df371f1550e08f4b848d28d957817586fba395556a8e24e9c

SHA512
a477a9ee334424281dd104748392c04cdb902d4de1e3901cac15de94d8291fe6d5f1a5f38582a9083fea8ee0811e8d87595780bd50733dc169d8bd2cbe6ad5a2

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
9c2c69011ea7c696ba8774c6d62cdfcc

SHA1
7d1661f5966adb0cb635e653de32b6788927c4d0

SHA256
ee0fde10a12c531788e7fd2e29f86f12f9db67b8da6ad0969a9ca51c0e48dc3b

SHA512
f59d326b7bef57a0b0704680fc10a56c66483a0fe48c1155e199859e71c75b9692d2014c0500041d49798ce5e6062443e42fc2ca7ce1f0467b0f39085baa37aa

Download Submit