47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10

General

Target

47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe
Size

1.7MB
MD5

98a722e086f57614b4cd338760417591
SHA1

04a4b0a633da300a7f06d1593c0da9ad1a8880a4
SHA256

47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10
SHA512

c4b86d4ca29f504ddb7d9777b189d6f6e18fc04c1a4ed65a57448a551282691d5ba55f4c228b3ddca3a5de8d5552eba4177e36c1223f43721220ceb57afbb678
SSDEEP

49152:DqZ5ikLQoRxUPRh9yzrWN/5nioWLnU+qt1FO7vD:eAWQeUP3qrOWLUt1mD

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2488	47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe
2488	47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
460	Process not Found
460	Process not Found
460	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2488	47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe
2488	47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe

C:\Users\Admin\AppData\Local\Temp\47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe
"C:\Users\Admin\AppData\Local\Temp\47774da5b1d7c7afe7b9bcce849f2390463521d33a2d502ba4d9c0f662773d10.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/2488-1-0x00000000754D0000-0x0000000075517000-memory.dmp

Filesize
284KB

Download
memory/2488-518-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-516-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-514-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-564-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-562-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-560-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-558-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-556-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-554-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-552-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-550-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-548-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-546-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-544-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-542-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-540-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-538-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-536-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-534-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-532-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-530-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-528-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-526-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-524-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-522-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-520-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-512-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-510-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-508-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-506-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-504-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-503-0x0000000002460000-0x0000000002571000-memory.dmp

Filesize
1.1MB

Download
memory/2488-7785-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing