20902f148eef05a086c4de9d76fbf90b6031711e54fc4b86b134bdf5972d94bd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024091881a676f4173c2fbd91157b0212bb9088poetratsnatch.exe
Size

14.6MB
MD5

81a676f4173c2fbd91157b0212bb9088
SHA1

d0ff1988a1baf8e35dda7d91dfc4e8681a415834
SHA256

20902f148eef05a086c4de9d76fbf90b6031711e54fc4b86b134bdf5972d94bd
SHA512

a3c6680fc079b6e724603347c6e6e09318e7db9a9c823672851a8085438f4fdcefe2b39ded73417d3093c73dc2f2eb3c855ca6f219666d45e2dd60675738978a
SSDEEP

98304:nWUmVcwI0OBV+k6BQcRrYJsoOUR4u6f5qBKrwi+6pHtWePo3+B:WZcwI0OpJsgR4XQVi+6WePg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024091881a676f4173c2fbd91157b0212bb9088poetratsnatch.exe

C:\Users\Admin\AppData\Local\Temp\2024091881a676f4173c2fbd91157b0212bb9088poetratsnatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024091881a676f4173c2fbd91157b0212bb9088poetratsnatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads