e4fb703d57a3118ce43abfdb17202b682d45d4c13d22b24ed9413490c5070d55

Analysis

max time kernel
95s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4fb703d57a3118ce43abfdb17202b682d45d4c13d22b24ed9413490c5070d55.exe
Size

10.0MB
MD5

5d902c0a1e26655f8edf10ab84b03d0e
SHA1

385fcf6c00be7c6f174f2dc679904322861c2992
SHA256

e4fb703d57a3118ce43abfdb17202b682d45d4c13d22b24ed9413490c5070d55
SHA512

de7cd8624b5bc10117096d1359810e24b48adcbbf9e12caebca6a849929859410f258adb1f6f59d9700608e93baee947e055e26ab821365c75b561198965f1b1
SSDEEP

196608:YeS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:YeRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4fb703d57a3118ce43abfdb17202b682d45d4c13d22b24ed9413490c5070d55.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4876	e4fb703d57a3118ce43abfdb17202b682d45d4c13d22b24ed9413490c5070d55.exe

C:\Users\Admin\AppData\Local\Temp\e4fb703d57a3118ce43abfdb17202b682d45d4c13d22b24ed9413490c5070d55.exe
"C:\Users\Admin\AppData\Local\Temp\e4fb703d57a3118ce43abfdb17202b682d45d4c13d22b24ed9413490c5070d55.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
471bbaea9ac54e1f6116f7a2a1889d2e

SHA1
06ecd727048d434e667fcf62a5ddec6d9aad23ac

SHA256
67e71e01214f8fc23b13e6c720ff88d817a13423e3c36fd5591f7f1ea8dc0c48

SHA512
a2846f109c342054f3ccf6f5c0d71e0f9e036cc6f16e7f86d6776da29555b3ad14327d7ae1b48db788fa6d7b33a5d78e078b9ceffb4bf17d426cd71e685fb5ae

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
db731b1d2a18dbedd787ab2d8d2f7508

SHA1
cccd23b6231bf9efe4b653f197673c4bc27375b2

SHA256
395a9e931a84b13e427c3071b7ea957658bb2c8afa232de1e16924c70e7b3a78

SHA512
ecf4bfec54b1e007b17063f5215da6a93a90a4ac7c688e7648dc97a77d4eb42bdc65fb6f80592266f22b8b65cea31b71bb8c8484b5a47d406eff2efa23b0e433

Download Submit