f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1

Analysis

max time kernel
128s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1.exe
Size

11.0MB
MD5

8274d296ab0881aa111582cd600f7db4
SHA1

64830540654ab046cc7924c57bdfd95d24a1d6d9
SHA256

f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1
SHA512

d180b4da05c9fdd25029639b5018e1225b902327c71223e6afd7d9984eb9f99249f5fa6c111c260813c204f066e93551f7c3047f0858228368dfe61cb69b6095
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2276	f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1.exe
2276	f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2276	f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1.exe

C:\Users\Admin\AppData\Local\Temp\f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1.exe
"C:\Users\Admin\AppData\Local\Temp\f4cb53a1266dbd95d92d72c1dfadfab80530ea4c0a506d86f8517a5b0d79c4f1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
fa7c544d507ea71b31b0756fba3d9b0d

SHA1
b814080343d469ea2f70cebbabd9d57e29a58cf2

SHA256
808b31cd9ddd5043b96039330cda49d8766569c9258668b787b724a1d60d61ea

SHA512
f9c3da478dfe5e924e159bdfe06eb31223ef9d258c4a5b42b448b394436cbcfa035dff104a12706f614f980dcc8b2b30c8b11c441eaaea5bbfe6e784ed5b103c

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
6b8df0f258a58523bd165cdad37c3f8f

SHA1
670009c92a6836986c65eade822e13a82b3ce2eb

SHA256
d466e2b88ad82cacf6516dac1567c05db98a08fda87a94c0e11302de0ccebd2f

SHA512
c6edcbb5d169d778a79e1b0873b4b57dcd68131b98454c1145b637ccf32bf2844798f22b0f45490aa93f19ede5e995fb23d5520b23b9890280512f8698e669c0

Download Submit