ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53

Analysis

max time kernel
114s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53.exe
Size

10.8MB
MD5

ce394127b591ce2ef10fdfe6d3d1c78c
SHA1

c4ecbb5a49d2738afb910274785d383f4b4fb57f
SHA256

ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53
SHA512

cafc1184275697a04da2377af2034e313285fc585079a0893a6f94b69c5997a773ddf416c25a2476ff61f9b9ab13d944a60cf448125218d0eaddbe9195f49a28
SSDEEP

196608:hHWWK8lSSJ7PbDdh0HtQba8z1sjzkAilU4I4:hHWXU5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1344	ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53.exe
1344	ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53.exe

C:\Users\Admin\AppData\Local\Temp\ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53.exe
"C:\Users\Admin\AppData\Local\Temp\ac6448be0678bac2b0f0507986201460a008904cccb3875f778bcaf20a334e53.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
7028d1feb890dc5aff49ab089ca98753

SHA1
8df401ca9796b5bc8205eed8ed7350b9e4ba8038

SHA256
0c912c2f3c173cedae41c4dac5b4994259b579ea184771165b9c15510d5f1d2e

SHA512
a52696525a01424b14e5c01bf3cd827eb4b5866837f547988e68e5e8918cfc400d405e6be2f1aa1f3afff46076192234317f0403c3b1c8fae4472e62dbd28317

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
3e1c1fa6e5e6836d9330e4cd864c16ec

SHA1
378d69ad7ef9dd63bc5ea8b08b2f598043e422c8

SHA256
602b81c8278ad452650ab519bcc40522796f290acd43df5d90448c72307eac4b

SHA512
0c1e5c3dda847e5c8e9d509c8f46d37e199a8fed58402945567e17cc7e69ec9209f2a65d578ceb1d2cc4c8748f1802a9bfc799cdcc46ca1b9c271452052d19ef

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
5e9453a3972b5682767a8ebad8263992

SHA1
7c2846dc3970d0b8fc7ac664ad8ad251dddd8fcc

SHA256
cee29697b03638015441472362e6e3592175ac535c6662893f6af0475c7f7113

SHA512
fb77d8f188a06f57d0e0efa62e4bf633738244c3db5546f0cca54d54ce6bca55610d7ef0022e6fd1a95011070caf48c3948368f444cfd0c93cac91c0aa18aaca

Download Submit