e2d30a92d215ea6a88c52ee7dccd5223e09725b4487c87347448e78197c8b171

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Elite Hacks Pub v1.3/Elite Hacks Pub v1.2.dll
Size

308KB
MD5

5ed41eb913b93b18ed5db7dbf639555f
SHA1

0defc4510b3c0d0b93cedc9075a4bd91b71ff5e1
SHA256

798d19a5a1a00d9f390507bb39308be77d7cfd3370b37b815815914d0fb41cbd
SHA512

87ba99138865fc72bf556dc6c6b5fbded0835be5cdeeccd8c94a804184b21a43a14ba32174f1f1e4bccfb517684aabcfdeded1c6e92aa4cd0608727fe66af3df
SSDEEP

6144:X/9a1dBR47jDh/gYosRvBIfT1S3lURAO0T:XYdD47qspBIfo3O2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Elite Hacks Pub v1.3\Elite Hacks Pub v1.2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Elite Hacks Pub v1.3\Elite Hacks Pub v1.2.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads