5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118.exe
Size

9.9MB
MD5

a982af8f023662d7331fbf437dfefb7c
SHA1

83fb1e3a0e23469f9163fa1122735008e4445dbf
SHA256

5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118
SHA512

01ce6e579c4355998846ee4a01f3fbc9ac5accd567aef135fa3ccb8cb48efde70c0cdb5053253e32e4a35fc43b7c976fe33a79a936baedaf2c1a88d49800cf3f
SSDEEP

196608:NfS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:NfRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2476	5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118.exe
2476	5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118.exe

C:\Users\Admin\AppData\Local\Temp\5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118.exe
"C:\Users\Admin\AppData\Local\Temp\5e3a16702a727c5db677478ca944ed24f87faac80d5bd41600b7c78bb9abb118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
2f7c6d359b9a32c5a3cca1bf02e33932

SHA1
c0a76798c5c91a091437bc0c5fc4dcbd254321b9

SHA256
f03ac8481ac41f20479f68680cbc634749712b0a988d447a46627879e097e54c

SHA512
4fd40f0e4a66dca09384624d6771795de6db23129096b7b1e04ea290f22cdecdf1ae31f0a9004adb44ffff403fd2d7c7f8d52f80db3416c2df3cda7db116f205

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
166f2fe7018eab040a959c541577ae70

SHA1
66223bf2cc1b80a1fd9bd869c0bfb80a7f886084

SHA256
2ab80ab1e10476112bfa397f57847919946696a996aa8bd1c7b9d6b3479addd0

SHA512
22cc8b198e9660049d4414b649345bd25e13379197ee9ec5cbc0ea205bdb6f4786b57bd2d67cd9dd5439785f924bbdb7c05c70da906c7aaff5fc570c3830197b

Download Submit