4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f.exe
Size

789KB
MD5

16baaf42866f209a0541f94c66b66893
SHA1

b99e88caa2c1ec5d4695d2e82c4a514158401c07
SHA256

4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f
SHA512

08da0ae2460f652a52eb6e9dfbfb6163da2a6692651fefc962a1b2d93e793b02917cdf93c7540527730a32906eafcb5ae2815587760907bcb8cff6238701f506
SSDEEP

12288:gPuWSr24vLu7qSrzr43jXnRoUlq3dusfRoalDC01J3GBtLSI:XWk67qSrzr4zRN1sfRB1J3GB1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3092	4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f.exe
3092	4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f.exe

C:\Users\Admin\AppData\Local\Temp\4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f.exe
"C:\Users\Admin\AppData\Local\Temp\4c58bd9580ed207e5830b7318e155ef7189b56f99df3ff985d490eefa95df42f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\info\cust_ip.txt

Filesize
13B

MD5
907326301a53876360553d631f2775c4

SHA1
e900c12c18a7295611f3e2234bc68e8dc0501e06

SHA256
d5543b3a5715587c9c0993a7f56f3e1ee445af837f62c38f2f3457a2ea8d00c8

SHA512
435c1fd96b79b70c370d6f769d44eca3e682404189ff42a6b5718c21bf9dc8358d72c115d68dc25014b8cb9c709af0e64de012103fce687cf4a340fa8f3ea2aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\info\today_time.txt

Filesize
20B

MD5
7d84b10d16d52e30e52d5abb3e1a3f22

SHA1
91a91ac401edad26256622536378331831ae99e9

SHA256
5e413792dcf693d942da3c460474c12d7962c2d3d17ab40e394dcd6b26cbfe17

SHA512
e0c31d303743d8e3bb7d998b0cc05a7289291a46b8e41670aa100d4e0813fda40a9d5eecd1e8d86bfa7839c654cf54db20565fd9b721c14f545714bf2fe4df1e

Download Submit
memory/3092-0-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/3092-15-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download