78dee99bb9db69e5d0025dd91db3e03ff5f67ed475596abc4d949c64bc62df20

Analysis

max time kernel
141s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.TScope.Trojan.Delf.21325.10001.exe
Size

1.1MB
MD5

ee53c7ade3d084167ac3f7149bd20d22
SHA1

dc6a453a8b98ab405842cd97d62fcb9aa57f0e4b
SHA256

78dee99bb9db69e5d0025dd91db3e03ff5f67ed475596abc4d949c64bc62df20
SHA512

9fe66b9b9b82b855baa25d7df9150bccafb4673d6378f705e3f302e82741b766084d6c2e6a6c14c7a850fbad8343d871f49cab23380bef4a3c22db8bd6fe704a
SSDEEP

24576:axWHq4i3NrgYWafP4D1GDCoQJ7a9q3p19fcfkKPyClOB6BKR:ridt21TaIZQfDP5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.TScope.Trojan.Delf.21325.10001.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TScope.Trojan.Delf.21325.10001.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TScope.Trojan.Delf.21325.10001.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\licencje.ini

Filesize
14KB

MD5
306b263940b1c687af703a7842394fc8

SHA1
b9cf93eea750db03bad06fcb0ba80bd2016c6356

SHA256
3ef08cd30cdad9d782b05b503ec223768506cd44ae40a9a6dc074e1450991609

SHA512
5eab2829201ef6f564ef099a87b15ee1c792a7b223e706adfada156461873c849da3d3327bea4ea937bbbc213ac0fa95579d45bab31b510fee810f92183b00b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.ini

Filesize
1KB

MD5
688dbb35b029313328473366bc3c72c4

SHA1
8de773ecb103b7a5e20e09f912c57c9996ca3094

SHA256
a3dcec77a670cc512cc709f1f3b3a54b14b0fa7b046dca196ccb18d8f7831e59

SHA512
46233b4a1459bfeb5b321c57f2a718d2ae5379127cb91b58216f762f83830e7f963d90c8dfce0dbd8756e6e48d913223d418a083d49df2eff2506c760a7e807c

Download Submit
memory/3024-0-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/3024-17-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/3024-16-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download