14a5cccaf17272a09d301405fcce5d3dd04df9da57e74ab438fabab809872496

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d52936ed6c017d36c205580d7aa9feb0N.exe
Size

44KB
MD5

d52936ed6c017d36c205580d7aa9feb0
SHA1

0cd9f09774ca25d47af1561cac3e4c28e49eb188
SHA256

14a5cccaf17272a09d301405fcce5d3dd04df9da57e74ab438fabab809872496
SHA512

65b23d40b6fb3958255ab2bf250fadb5403e6326aea428107c3c05bd8377874bff2924aa57b99e73e1f4c72dd86be3a3e70fb437135dda78438417a7b17e2b89
SSDEEP

384:g6ATiFJoV1E93x5v2jRzjp1mMt+x79KYCO2lMqJ3ylL8O9LXOvUR:cir2m5v8OMtspK3O2lZJ36h

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1880	d52936ed6c017d36c205580d7aa9feb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d52936ed6c017d36c205580d7aa9feb0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1880	d52936ed6c017d36c205580d7aa9feb0N.exe
1880	d52936ed6c017d36c205580d7aa9feb0N.exe
1880	d52936ed6c017d36c205580d7aa9feb0N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1880	d52936ed6c017d36c205580d7aa9feb0N.exe

C:\Users\Admin\AppData\Local\Temp\d52936ed6c017d36c205580d7aa9feb0N.exe
"C:\Users\Admin\AppData\Local\Temp\d52936ed6c017d36c205580d7aa9feb0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\379436526.dll

Filesize
25KB

MD5
69025c6bfdb9d416aa2c44899fa3be75

SHA1
34380cef1e0466372c7a91b95056c1c25e95ffc7

SHA256
dd0866b97a87772bdb1d252eb5752d3c7a4e43ccc9fd5983045138bdd350c857

SHA512
b6ffeb07add5679ed55026fd0b5a2d24212a1162621536b9149623beeb209a7cf4563bf573f3e807de23f4108f3f6aa15e4951d21a38c87767cf16ba0210d4b3

Download Submit