59b58fd159e78440a8803a51bcbf7960ad511327fa96ef96bece3fa716ae4219

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b58fd159e78440a8803a51bcbf7960ad511327fa96ef96bece3fa716ae4219.exe
Size

10.9MB
MD5

6a590f45a233338520131a53248f8f65
SHA1

a45eaed1a6817fafd4d4a2f5da8bda23abc0a45a
SHA256

59b58fd159e78440a8803a51bcbf7960ad511327fa96ef96bece3fa716ae4219
SHA512

4b4399aecda1b46fa4b34489e53f70162b7a6cb5409753ebeec7a1e34f3e3c08de1fed371de5f56561d82acdc4704f16f5e912ab066b252fccb9c050c54f67ca
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59b58fd159e78440a8803a51bcbf7960ad511327fa96ef96bece3fa716ae4219.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2580	59b58fd159e78440a8803a51bcbf7960ad511327fa96ef96bece3fa716ae4219.exe

C:\Users\Admin\AppData\Local\Temp\59b58fd159e78440a8803a51bcbf7960ad511327fa96ef96bece3fa716ae4219.exe
"C:\Users\Admin\AppData\Local\Temp\59b58fd159e78440a8803a51bcbf7960ad511327fa96ef96bece3fa716ae4219.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
c947869903b81a20245473d7fc8a75dd

SHA1
64fccee8c0050615a529744d3902f73d3f5d0f4b

SHA256
ab36e2d72325fe290d2b6790fb08944f9e668e325bae5493cfde7985465c899b

SHA512
23f5cc211a05e96f359686ae6d0d0fe72930691626d9633fc1af901cc3d1c6a31f8e4e8f7fe972f62c03a19809d1fc325275d0d7c3c1ef6a5ea3ce64673d8837

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
47228c40b4f451da08c25760c4cf59a2

SHA1
02f40d422f83cb56ca63c114a9a51628536a2986

SHA256
ccb1078a1adeb89fa7370817c8e5d0f728ba1e0756f636b4eb627ea35693c096

SHA512
26aa514c4f1a375b0cdb460c0e8e323d6025a0dc60067933b1beee8816512f6ba85fbed081ff2ac2291eb0c4f516bb5932dc2291098110bf11c60c7f953e9928

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
cff34cc804172cebd013b7fee6cf7f1f

SHA1
bae669d649436fb93870b93324af31eca28b68a6

SHA256
942bc42c0adbe21272cd890b756bd685efd0c3a184c67eba01ef9bd758d9fe7e

SHA512
a0a680df96f735c3194040a46fde4423fb428fa00df1292f7dd0176d6e4bf5134b685a6069e1cd9e73d50d42be6e60866b4037c42b564b7bd25f3fda2488fef7

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
7a8e30c2d065b310c5ecd615162f98a1

SHA1
1f40e07c3d935b39d068bdf5922dbacc0a61f775

SHA256
7c2433729ecc75413a86b063e32967e0947ce3af68db6319fe51afad34e50809

SHA512
e58d7f283f9b799cc8e91b516566c7771095a8c8d505bc3eec90d1833f412f8d7df537063db404380305196962130f58f0c19074913e8ccd67c2a0d7e0e77e67

Download Submit