d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe
Size

10.9MB
MD5

bb7944196510ee90e19bd44b636d5d4b
SHA1

ff5e01b787a8a6e4dbe57ebe816f2cf6719cd3da
SHA256

d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254
SHA512

91976ad15f0f9d89aa93553e3146043c621404bd61e1481889b17d4ba2129ed3c2f1fb13e9c9b8b47e90b0d9b74d11fe5ffb6fc7008836a9b552996e0ca61e7e
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
3056	d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe
3056	d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3056	d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe

C:\Users\Admin\AppData\Local\Temp\d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe
"C:\Users\Admin\AppData\Local\Temp\d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabE448.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
bda354fd8d94f78656f74199226ed83a

SHA1
c63fccdd5c9cfa2676a02a21ccf17edca2740c07

SHA256
d5285eda8f70a533d68454f2965a5f93523d044b588abc6e2d8bca2e27f8615e

SHA512
35533f210d0fc4d4dfdd6f64b39f12d95f95b09cce1cdb57abd8330f6b38d85058c84b16db5070558f02f1a85b410326b7c0e9f773d9d1971630139146a109db

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
65cd2dea0acbb8b1c157f4841678b41e

SHA1
224db79d0fce5636b83400dcbf73172b7e999f08

SHA256
527db4b7827249c54377ca5d642b6035df2c2cffaee0820b40056be8d4317092

SHA512
c714a2106941f88bef9f4acb383395731cf5637c04553f62a303d5d34662ede8a4055a92286595666208b89ba375d2cc13b1e727a0fb96df84c518dbe072cfaf

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
68e9400cbd96b30aa7a5cb853903cd0d

SHA1
baa6994c8a91a74da7a80131ae07c68aea4e4530

SHA256
11bc4328e3d0c041e5d8b9707bdcc8f57e234e3729632fe0645e51ffcd338099

SHA512
962d52bf54cbd6b73e436f04058a5058526c7461acd2f901950a1c37840942c4dda645495f269b6696a7b37b3f48732b85698556aa78bc0f335c97f68e292b13

Download Submit