76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa.exe
Size

10.8MB
MD5

62a2c8b19bd1413a8c98d970942f031c
SHA1

06474d18a6bbb74413a352463eeee760155ea069
SHA256

76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa
SHA512

7ccf903fbb54324c76014ed6fbddec5972400112dea352dd900ac42158de9a1226d8636c3e65912b04f2cbc96709be15c1931455966518664f6f134d3980047b
SSDEEP

196608:hHWWK8lSSJ7PbDdh0HtQba8z1sjzkAilU4I4:hHWXU5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
3032	76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa.exe
3032	76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa.exe

C:\Users\Admin\AppData\Local\Temp\76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa.exe
"C:\Users\Admin\AppData\Local\Temp\76876401d628c34e64dc9562929206ba9721972e91cf61611f29e05c8efc36aa.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
3650598a6da605948bfb9a5ec32dad2d

SHA1
af240396bd2a2dc5a37c01b3912d4f87bbb0d612

SHA256
25f2fb78efe0efb7e49b4379fa0fe62f7d3c114c2a796a2fbce29cbc5ce0d8a5

SHA512
aee9709a676a7331319e95812054924e70e43f092c4952b6585ea88cfaebc2b757e9be10f66462c11041f9d7c31b297afde887e48b6dbe8042d0e49cbfd93018

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
26becfeae5d0b5ecd88027af5cfbb0ef

SHA1
1345b5b6d70f279b2883fc350972087a4be4babe

SHA256
8f9bc6853b440207de09f564a0eaa38de2ff90b38b97f1fc722612061c9acae6

SHA512
79dfd680f64489a9641463ae4236eb7f973a4f56f7b4fc0fdd6bc8c59c6c803c4405a7368afed95a1fb3565327ba87fd1fc36c917621723ff3c3ef315751676e

Download Submit