195688fdc5454fb7f6ba8188015e395bfe86876a9c0e28b818944ee264f0e77c

Resubmissions

21-08-2024 19:30

240821-x76q3sweqg 10

21-08-2024 17:42

240821-v92h2avgpj 10

12-06-2024 16:01

240612-tgps4a1bqh 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe
Size

879KB
MD5

af466faccd8bbab030d12caf7b16ea61
SHA1

e18711fe226d39fe182c45ea1a15ccc587980b67
SHA256

00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7
SHA512

2599b3b6db13c14e36bc24980da5457c8788624050ad727d2b1d8975b6405e1a6dfee9829a849900edcc7cc831b69604cce9e6e7e0080835e426df343a1d6e64
SSDEEP

12288:D+of7uHr7XLo+U90C447TmTWCsNWGHBm++WDzLGfWCayErUUxmptN:Dr7uH3vu0B4OWZxPDnG5ErUn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe

C:\Users\Admin\AppData\Local\Temp\00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe
"C:\Users\Admin\AppData\Local\Temp\00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-0-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/3644-1-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-2-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/3644-3-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-4-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-5-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-6-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-7-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-8-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-9-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-10-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-11-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-12-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-13-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-14-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3644-15-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download