e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3.exe
Size

9.9MB
MD5

29a53a7bbcfeb43a331fe8bb06bd6195
SHA1

bd78a70d40a1732f49281f32dcfdcf29e7ca61db
SHA256

e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3
SHA512

a9254a7252ab75c4d369cb647d221cf513b18a115f1c176221a8407afcd519d0b42a51381f8790325eacb0dba4e6a39a75c21f38ab76c4b84d503ef9407c980f
SSDEEP

196608:NfS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:NfRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2732	e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3.exe
2732	e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3.exe

C:\Users\Admin\AppData\Local\Temp\e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3.exe
"C:\Users\Admin\AppData\Local\Temp\e458837bbfae88fdf6971734a91d9a598e3ce03933fdaa8b74019cf50d0ff5b3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
6e42a41605a60ab83a51b2bbc02c6df1

SHA1
32a82a8849ab1717e52f025b828b1fc95822a8a4

SHA256
8d3aa52b34e7dec9eb6392fff0c79ef05a0c26bf348aa30428f32c89bd9e8b9e

SHA512
ca2f32e7eb9314dd9eb2c40441a873e610882c263ca4e6dab00aeff7f3e7da2c23a822c8ff3eef96ebb53e875e04111acb3ea8ceb44c4038907b53c4e981c044

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
fa55b770c2bed21df01336f20fe9a47d

SHA1
82665a728cb6db284ea8f12907a9cf0f9e90934b

SHA256
e5bf459ce80fa79b5d0ce5cdbd0f458cfcedcf1ae50902dd0f4a0b01f8c8fd03

SHA512
2b1f7f103c8511493629f2a72001c93619de9d86a48867e70cf5e28e2b8cfa69f64224d479ba5d081ba794d7cab9c8c7f1ca4d354f99e36873f93d4310fb8eb5

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
a3952d65fd92a819d58b7e3af283aa79

SHA1
acb418319913f008643af442e6491aa2c0da86e1

SHA256
e01742aa89d947a46ad090e9fd3a34db3c46407bb559b0823159aefd94a03a88

SHA512
61d911b2ceba99d273500259c1163cac7ad92b87a34bca5440239af81a6c2306589117fb21d306a6589db3bd8f27127b05be06ffb996a848cab70e8238700aee

Download Submit