0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0

Analysis

max time kernel
119s
max time network
152s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0.exe
Size

9.8MB
MD5

d492a5c0983925764b1e56d26616b777
SHA1

b8a9c9d46f6da426debf5cacafa835aab2dc6b42
SHA256

0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0
SHA512

4f1aa65baa21387a882ce316c8d8b00363dde5369e75bbc316da56419b63b46ff5835909eec82dbb1f1056764ace4110a7106a90c648a3a9a11859b75fb58f6f
SSDEEP

196608:TqVSSJ7PbDdh0HtQba8z1sjzkAilU4I4f:mV5J7PbDjOQba8psjzyzf

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2988	0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0.exe
2988	0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0.exe

C:\Users\Admin\AppData\Local\Temp\0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0.exe
"C:\Users\Admin\AppData\Local\Temp\0f6d59faa3bd51d84e758ba986ff994129d1c598938d349d05d62b0519209cc0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
81cd74e55bae16defd25574a8af9eb26

SHA1
ab4e5fe651721205afddddc9a00854d03d513e72

SHA256
8bd22e19393dcbddfc73facc094f29cc1a1355f7fa3f39b1b1eed8a5921cfd93

SHA512
e447b4a77e5c8ff7af929410e819bace3fc270869fa69f4060906e4923880860e22a0d0d384c5bd0dce20a5627df96eb3789e20ae854199edbb50ea03b5cf20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
4742a9020297e5b9f66563fdd719228c

SHA1
e193540dfc1f9e753f726c637fb8f7755a8d5049

SHA256
647c6b6880ba01be49234546aad50f8d9c0750b525fe2e67efe37a8c6eb71633

SHA512
44ec9a92dfb9e642391fa6d69f232f3c61dd396fdfb0e193cf1eb57945ba8f027929b99b63b5d5b2e00c977748ee40986158a2de12700470c6462052ff03927a

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
eb3455708e6e8a575a43fd37f894925f

SHA1
8b3ff7a6c9eb0bd5ec9ade1b68192d155eae2548

SHA256
7c8731f2e37a0cb9af44e419c28162e61725af726f62f3fdc4185e84b1cd7242

SHA512
6af42989aa9d62c6e00c841ca9e71637a2d869031cdb2db85c9777f6c941c6970c12b9d93b9524f401913f8df5cffcf682ceb23ebebfd13017e6e1fc6262c58e

Download Submit