fb662eea8e09f819738d7d07a8b72b876d0b58f6cd44ec56140c005ad4a026ef

Analysis

max time kernel
112s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb662eea8e09f819738d7d07a8b72b876d0b58f6cd44ec56140c005ad4a026efN.exe
Size

9.7MB
MD5

2b824c0142540e5ee27ee33b97bdb2a0
SHA1

6fa9dbc115845ee0efbb7d65b8dc97a4d97b7872
SHA256

fb662eea8e09f819738d7d07a8b72b876d0b58f6cd44ec56140c005ad4a026ef
SHA512

d88a0483c345296221cb1b79b4f9ea60682d69932839067a0e5a9adf0c0e2c5bb6423805144a82063171715e2a21d442f4baf9dc8591ad2a199d1192da5eaa1d
SSDEEP

196608:+LqYqUBMGjACEq5wqY0QbSsTq0fzPfS7gJ0qLwoOELx5M00:iq+MnCJwqETry8M6rB0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb662eea8e09f819738d7d07a8b72b876d0b58f6cd44ec56140c005ad4a026efN.exe

C:\Users\Admin\AppData\Local\Temp\fb662eea8e09f819738d7d07a8b72b876d0b58f6cd44ec56140c005ad4a026efN.exe
"C:\Users\Admin\AppData\Local\Temp\fb662eea8e09f819738d7d07a8b72b876d0b58f6cd44ec56140c005ad4a026efN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000000DB0000-0x0000000001741000-memory.dmp

Filesize
9.6MB

Download
memory/2732-2-0x0000000000DB0000-0x0000000001741000-memory.dmp

Filesize
9.6MB

Download
memory/2732-1-0x0000000000DB0000-0x0000000001741000-memory.dmp

Filesize
9.6MB

Download
memory/2732-3-0x0000000000DB0000-0x0000000001741000-memory.dmp

Filesize
9.6MB

Download
memory/2732-4-0x0000000000DB0000-0x0000000001741000-memory.dmp

Filesize
9.6MB

Download
memory/2732-5-0x0000000000DB0000-0x0000000001741000-memory.dmp

Filesize
9.6MB

Download