873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe
Size

140KB
MD5

e2d479b0027b31e9d976c5e561fa68a0
SHA1

2cb55cec4d0206ec27d3c6273e4eebbb72130db1
SHA256

873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6
SHA512

4e9fab7faccece0061a9a344b37cb5278d66bb7bb4a9bf778af4ea0607e91cb1cb17d8603d5053271150157aa0b7b79a03b80d8e4ac06c2d36395f7e7dd9d984
SSDEEP

3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/w/Fnncrd5971c:hDeM7iNEkgiOb31k1ECuJy5J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe

C:\Users\Admin\AppData\Local\Temp\873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe
"C:\Users\Admin\AppData\Local\Temp\873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-HQhVLaihKbLppNWU.exe

Filesize
140KB

MD5
873f74a457117954ed219d1f9a0b4611

SHA1
fd67c2b996933c220bdfd345818a2072c0b9afb1

SHA256
2c0ee7d524dd9cecfdacd89248f3c1db8c64d780b3d767295c8bd8552c40611d

SHA512
3b1b1ff703dd7ad58cf1270e51e9f573a186b075d13152d80e6495be239845e847c049b53bc38a83bd636f180d6482f88a0b27b3dfbfaef2b636e1c4c945ca94

Download Submit
memory/2276-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2276-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2276-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2276-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download