4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362

Analysis

max time kernel
41s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362.exe
Size

10.0MB
MD5

98bcd01a539c689caae4c4d4778dd59e
SHA1

e80678fd21c7ea23fe6058dfbe8bacf55a3cae0f
SHA256

4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362
SHA512

4740326a8f1e164625f6f0e4ed8cf3893ba6486738b8abb412257984b971985f57487b3be794b611cbd8a71bb83f88294a5361ec5748ef78f911bbcaaef93128
SSDEEP

196608:SuS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:SuRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2604	4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362.exe
2604	4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2604	4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362.exe

C:\Users\Admin\AppData\Local\Temp\4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362.exe
"C:\Users\Admin\AppData\Local\Temp\4bec570256cad2babd9b323f25c3d078eafc9f8539a54213b712df500a9a5362.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
5f67a04c058b94fd8e735769cb180d8e

SHA1
8de7b46ef32c6c03132f0cbb00cc02a4e302cab4

SHA256
4cd77c925caca2493399f262ae77000d268470ad38b44c3d4254a39fbf9d8944

SHA512
2090127f3c00d3d3ff80c6a9b4e101bdea481eb2d899ee0606f0c63cbb2c64954cddd528778b3c94dbbc6dc8e15fef6e98a25c5073832a3f6db542c6998b15b9

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
5abc2ae6294cb010a974425d780ab7c0

SHA1
182d37391ccfed947fbd9fe21ba74acc81f87821

SHA256
39219a1687fad2e69c5856b7901eca3505d672ba21a45e839d690f60f1c85c6f

SHA512
c1d08d192004ecb40dcef54951ee205d9bef1a74dd4266947bc56cd298ddf53379d92a2dba1b98cb78d5a8b8205c4ef8d7e037fc56cf61de39b591ba5a6057fd

Download Submit