25b2f73042901f14cdb4cbe61d6aa16075c321c82b0677f8cc29303de887413b

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25b2f73042901f14cdb4cbe61d6aa16075c321c82b0677f8cc29303de887413b.exe
Size

10.8MB
MD5

e3998e3333b69cc48b5562a8d38b5160
SHA1

35e11ba146024a44efdceabe1171b204b9066c02
SHA256

25b2f73042901f14cdb4cbe61d6aa16075c321c82b0677f8cc29303de887413b
SHA512

2308a13df052d2b998b3612cf961f5a3812ae6ed9678631897e6c0a3c3b163b2084f7a608b0a6c95df6009dfdf88f036a89ffbb765f8fb8ac9fa89731c922ba3
SSDEEP

196608:hHWWK8lSSJ7PbDdh0HtQba8z1sjzkAilU4I4:hHWXU5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25b2f73042901f14cdb4cbe61d6aa16075c321c82b0677f8cc29303de887413b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	25b2f73042901f14cdb4cbe61d6aa16075c321c82b0677f8cc29303de887413b.exe

C:\Users\Admin\AppData\Local\Temp\25b2f73042901f14cdb4cbe61d6aa16075c321c82b0677f8cc29303de887413b.exe
"C:\Users\Admin\AppData\Local\Temp\25b2f73042901f14cdb4cbe61d6aa16075c321c82b0677f8cc29303de887413b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
8KB

MD5
a92d87e53070a676342140e084504867

SHA1
66d42f50f09004567d6a12c936cc62308091f1a5

SHA256
5ac1991eca0fb37a3920ec495c42c8e6ee634e9e4ed8dce51d2597d7ff22d29a

SHA512
bcaf18087196de62f47c178d4b7c397ae1f1b0261f3cf71a31d098539974967a1cb36c5b682ce5c2f3287cb95fc778a0449875de34417468a5d0e922a3d02941

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
a993ee952af620a921ff71809c78cdd2

SHA1
ecbaa4756e8f1a15daaa33423e45315653b9a384

SHA256
7fd1af4b31bba81ff6025a17514343e5863c18275adb138418fccdbbf508c1a8

SHA512
e69811852ac647e7a01b292ca7ba485900d44be06af4bf168f5621371ea2f8d278ec4541964a8def696aaad2b3b4dd9c3981ff4d0c890ded38f78d98453ef3b8

Download Submit