d5c17ff589cc44fddb5a83959efd280ea96cfcd1d2325a5a31ed2f7a0eb10472

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lkwg/洛克王国.exe
Size

581KB
MD5

a937a265c4d64697b467f3f1ab2b5684
SHA1

5b44159a8cd49caa4b6ecea28844a5ace67dd094
SHA256

fd4f8b5bc0916248aaf784e2d7c8a07bb1f1097d561a57a0648a48c661d50f2b
SHA512

6c367b1999eeff969a5a376e8e540c396408844d33fed19067916298521e4d1936dc7ab9a4a7be421de1f7fb4b429e1da49f698c605219951010d8a5a84033ae
SSDEEP

12288:LjJYK2Uokn1GDoG9BT7DnPurc3ed2UHtVhykxsW7iZsi3YoCfrdXiZHeTE:Lp29knGoG9BT7jPXUNvBmZWLw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	洛克王国.exe

C:\Users\Admin\AppData\Local\Temp\lkwg\洛克王国.exe
"C:\Users\Admin\AppData\Local\Temp\lkwg\洛克王国.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2700-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download