1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe
Size

15.4MB
MD5

e0db5e923682f5884bedb0e02c006e24
SHA1

934a18476ee0250668b56f3449e4de737bfb947b
SHA256

1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c
SHA512

cb3720a576f5f4c26aadb6944ef417c31038a0048ae3d4271a92391a479e33b5d72be4bdc153a0e5477c6ed1ac506b62ee7dd6ccb4d459fc58593c4f2c3bef9b
SSDEEP

393216:PLY2v6dJUbq/j5JXuWjntDVtoZwCBaQvoTKf9W88Oa:PLgdu2lVhxBtuwxwoU9w

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2336	1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe
2336	1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2336	1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2336	1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe
2336	1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe

C:\Users\Admin\AppData\Local\Temp\1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe
"C:\Users\Admin\AppData\Local\Temp\1e89e3382d4061fe99f1b442e6e847457158de95f1e9e67d8db3ee078054ff5c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000C91000-0x0000000001166000-memory.dmp

Filesize
4.8MB

Download
memory/2336-42-0x0000000000400000-0x00000000020BF000-memory.dmp

Filesize
28.7MB

Download
memory/2336-40-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2336-38-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2336-44-0x0000000000400000-0x00000000020BF000-memory.dmp

Filesize
28.7MB

Download
memory/2336-35-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2336-33-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2336-30-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2336-28-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2336-25-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2336-23-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2336-20-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2336-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2336-16-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2336-15-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2336-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2336-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2336-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2336-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2336-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2336-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2336-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2336-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2336-45-0x0000000000400000-0x00000000020BF000-memory.dmp

Filesize
28.7MB

Download
memory/2336-46-0x0000000000400000-0x00000000020BF000-memory.dmp

Filesize
28.7MB

Download
memory/2336-47-0x0000000000C91000-0x0000000001166000-memory.dmp

Filesize
4.8MB

Download
memory/2336-48-0x0000000000400000-0x00000000020BF000-memory.dmp

Filesize
28.7MB

Download