aba2aeaab544d7536f9b35fc39dd4f0e546a385a0e94a37bf9b0bb98019caa98

Analysis

max time kernel
144s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aba2aeaab544d7536f9b35fc39dd4f0e546a385a0e94a37bf9b0bb98019caa98.exe
Size

2.3MB
MD5

347493fb63f169a7cb91002cde2e34bf
SHA1

0a546ef058bc9b234a9d8f512cec87ea18280c12
SHA256

aba2aeaab544d7536f9b35fc39dd4f0e546a385a0e94a37bf9b0bb98019caa98
SHA512

dc859a225bec0e1b5aa610ade158a3863b3f497dbaae546dc7e54352786c80a5921b5e797bbbdfc0b8d5e091999cef688033c5fda7051d340ad5bed07af660a3
SSDEEP

49152:EySrGORAQcP4sK2JXaz2iAdo/cNatLbhhZoSdJHcZ2IxzU:5SrLlce2ZazSoENobhhnFTIm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aba2aeaab544d7536f9b35fc39dd4f0e546a385a0e94a37bf9b0bb98019caa98.exe

C:\Users\Admin\AppData\Local\Temp\aba2aeaab544d7536f9b35fc39dd4f0e546a385a0e94a37bf9b0bb98019caa98.exe
"C:\Users\Admin\AppData\Local\Temp\aba2aeaab544d7536f9b35fc39dd4f0e546a385a0e94a37bf9b0bb98019caa98.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-0-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/3380-1-0x0000000076E80000-0x0000000077095000-memory.dmp

Filesize
2.1MB

Download
memory/3380-3274-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download