bc2803f2b24bfd7f4e2e971323d950c2d7daa7ea9d0f1061d40d17a02afeaf1e

Analysis

max time kernel
94s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc2803f2b24bfd7f4e2e971323d950c2d7daa7ea9d0f1061d40d17a02afeaf1e.exe
Size

11.0MB
MD5

b15b78cc6cea99cc60a1e6c7f6228e2a
SHA1

7b1cfdab104383265ecd336320f3cfcd8678920b
SHA256

bc2803f2b24bfd7f4e2e971323d950c2d7daa7ea9d0f1061d40d17a02afeaf1e
SHA512

648b97d03d27d070f34bf8ec2c521a7a7b839060e2898507190cf241dbcb67288986bac2e842bcb59a898f6083cc95d517bdae38a87b9def98b0141d5ac57c68
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc2803f2b24bfd7f4e2e971323d950c2d7daa7ea9d0f1061d40d17a02afeaf1e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4324	bc2803f2b24bfd7f4e2e971323d950c2d7daa7ea9d0f1061d40d17a02afeaf1e.exe

C:\Users\Admin\AppData\Local\Temp\bc2803f2b24bfd7f4e2e971323d950c2d7daa7ea9d0f1061d40d17a02afeaf1e.exe
"C:\Users\Admin\AppData\Local\Temp\bc2803f2b24bfd7f4e2e971323d950c2d7daa7ea9d0f1061d40d17a02afeaf1e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
3bb598c17e31fe1dea4723173b09dceb

SHA1
3f1421ff477fbeafdcba270499cf7dab1b69189a

SHA256
e18a10e2f7d074e4ec45dd120bf29e9730961bc6fc2078d763c9d473e2eca4ad

SHA512
6f949206e8aa91199a18c0865f70e7a98d3802ee6a60e8231bd7e3a5d6aefdf51142cb11e7f84806c0dd7832a7fdd7d680d67892fcae3dca821f0438aa1385e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
b4ae39484ee2a6926f5eb4af807081f8

SHA1
dce5864335f1a2d9e5c9f68eb1e37c3a957043b8

SHA256
26d4d8ac9862ff3169dbbaaa59eef0444bbd94ec29ea4a1c362cd93228d3290f

SHA512
15d904d5f1c58180869385d8ad4aef0fafa4c9381a8d0bbcb27d04b1a43ece8540369e34816f73ce4a39d67e59fd45269ef05d852cf1a0a1563958a98859bdd0

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
a5da6a8d1c3b1913d2230cb3d488e1ec

SHA1
561efcc0d8353d3081ebf64ad2d590ec01f1da84

SHA256
60f162bd62f7c7aaa550ca87e3bd5192d563f45bee0a474701bd5c9cffa8fb63

SHA512
b3b8b832ba795305d1689a3cc1eea610c1cad2641cedc519b309d95816e2045014e168f60a9112c5485a406bd9f0a1935e5055c69821389a38877fe1a7d78b6a

Download Submit