b5bf9d60fa9a2fe9deedbe186384d48b08b11bae7fb66ed3605a2dd2e39093fc

Analysis

max time kernel
133s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5bf9d60fa9a2fe9deedbe186384d48b08b11bae7fb66ed3605a2dd2e39093fc.exe
Size

10.9MB
MD5

57a28bd0aac12dc2e1855e55b47c0475
SHA1

f3e8abf87097adf00efe2e28a508b7ef2f63b318
SHA256

b5bf9d60fa9a2fe9deedbe186384d48b08b11bae7fb66ed3605a2dd2e39093fc
SHA512

9605a2e3beac28698ac0cdb24a2dc273a2c32c1392adebc84d8d5cbff4f951d184b14c1a63a1b5a9d9e86d748a45c6e3c4f6d73e68e1c6c8c2956d3baba006a0
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5bf9d60fa9a2fe9deedbe186384d48b08b11bae7fb66ed3605a2dd2e39093fc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3572	b5bf9d60fa9a2fe9deedbe186384d48b08b11bae7fb66ed3605a2dd2e39093fc.exe

C:\Users\Admin\AppData\Local\Temp\b5bf9d60fa9a2fe9deedbe186384d48b08b11bae7fb66ed3605a2dd2e39093fc.exe
"C:\Users\Admin\AppData\Local\Temp\b5bf9d60fa9a2fe9deedbe186384d48b08b11bae7fb66ed3605a2dd2e39093fc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
456ffa47dca1e930291825a8194ddbc8

SHA1
2bad07a38d9602c965872def84148ffe75376a56

SHA256
51a49402ca36e1a9a57379331aaf739964e0031e64a08e80a1d81eca7da7ab85

SHA512
788d71c2de73911515f6b07aacbec690741ea5183b6f6e77d2aec3c05faca9dd3cdb05d8b8a5352e15bfd1699a7f396099a133624bdcb10e4281ad8bd713f6aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
8f74f4bf87b77adafef0451e1a140bd9

SHA1
1221a46b1d54acfe38c5efb642f33380658c5b7e

SHA256
4cdd0eda0bcc6999ddce1e6e86df8c498161a4aab16f3f5b717042ddb3e413b1

SHA512
feaf9868288b8fb5d8c4a26e7c9073c35b02d47eba8581e767c872df61434593e51dbc21b78bb7f6ce68ce0690376e3235e5221ce5a6d6c4c5ca08a789a87727

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
5f4f85b3f49d8e457b87d3ea6df5b6d7

SHA1
4d145e2799570aa27beb24babd6313e88d545225

SHA256
142b6ae32425430c23217979720ea5e39a930fd8263a10a42a3f2305fa89c11a

SHA512
879d2386b7094b6e17e3ae9786272f3b3d776673317f845602bd4a6164f32581807e0b658a182f48ca686bac187a7f5d8581668675b00048d21e9921a8ab1055

Download Submit