0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9.exe
Size

10.0MB
MD5

9211bc57af25920f0424cc645d8ff0d1
SHA1

d36b77948c5fb216aaefeaa8dc222d3867d50357
SHA256

0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9
SHA512

591506c95309e52b2772dde60e53510f758188fd29569ec570fe8629fbeddd65d89c0e3f58fb272593ac04cc3c8ecc57366645f271567d9f719152828700e35d
SSDEEP

196608:SuS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:SuRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2384	0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9.exe
2384	0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2384	0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9.exe

C:\Users\Admin\AppData\Local\Temp\0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9.exe
"C:\Users\Admin\AppData\Local\Temp\0b975dc9d8601a50dfb199390e3122e749dce3f827d74f3cdf0a1d4c28bce1e9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
ac0951fee9a97ae8379ed20e1af533e2

SHA1
1bbd21567ffe11d980bee0573378a1221334dd52

SHA256
b2a8195e3c397c5259d9bb34312a151095e11ffe7ddb498c3bd866df335e60b4

SHA512
ebbc2eb447ae0cf0d0e0a1f1c4d7f869b2c2cf206ddff61a2b954e9e9bad5419154b4d618f4601443fe34cad00d42558cf4b2a857dc33c9da9063298f32235cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
d18ca685e0da4fe4f1b1db627364c0c2

SHA1
bc7e95879aaa1f387cd663ee28eb6f9ccb24e146

SHA256
db55b29175c01b15cb9a2035e248af43528264079d3a3e2f28cf98167f135d54

SHA512
4ac272c72fd00585c3c676f4eaa6be938126e05e1fb433c08a5ac97629efcbc38cacbcf1af3085e0222b7f3daa49e15645b610fd309dab7ea1bfa4545cfea680

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
4a5a818dcec5d5c00aed6c09be8f66d1

SHA1
3cdb8ef90aa232dc9c37be54c1b6104ca4ba5844

SHA256
9ac488d38abf8e53ec2626a81f8652806f15b66136f306db79e55c7821b4bea9

SHA512
ac50d5e89c0dec3beabcd0a4607b8c3057a9252c5ae52173ed7c3e36cf3e0f6e6a3395804c6b4698614b60bb91f5fab3f9aac0efcca71b202a3ccac615e3214a

Download Submit