9ea53cfd98b2ea0072fafa0fa06965cfb4a12f43e2127c375eb960789c325241

Analysis

max time kernel
94s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ea53cfd98b2ea0072fafa0fa06965cfb4a12f43e2127c375eb960789c325241.exe
Size

11.0MB
MD5

6d5a0801bfa2e30d0a72e2ee63ce42c3
SHA1

6dad170f72740b0c231fa708ebd8ef677589f2cb
SHA256

9ea53cfd98b2ea0072fafa0fa06965cfb4a12f43e2127c375eb960789c325241
SHA512

74576182252cf33f5ff64866296b515e051a01a9d3f512397552f36d4bae8db53c0a0337ad6065c5c69cd677a4b2e5800a8a2558579443b0f6fcf71d4a00e772
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ea53cfd98b2ea0072fafa0fa06965cfb4a12f43e2127c375eb960789c325241.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	9ea53cfd98b2ea0072fafa0fa06965cfb4a12f43e2127c375eb960789c325241.exe

C:\Users\Admin\AppData\Local\Temp\9ea53cfd98b2ea0072fafa0fa06965cfb4a12f43e2127c375eb960789c325241.exe
"C:\Users\Admin\AppData\Local\Temp\9ea53cfd98b2ea0072fafa0fa06965cfb4a12f43e2127c375eb960789c325241.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
885640b2f17bc13c8bcc2891fc608fd4

SHA1
b1a4ca9497baedc70eb3c9e3429bb5f767923970

SHA256
d8746a7def3a4f3b08a52cb8f368705f3196b2360823bb2ab43673506835f6d0

SHA512
726f963222dc0d132ed60e7254892e0b2d4a57ac65d0b9b653c20790fab88b541d1cdd955dbb52e13b11acf485796f083fddf75a53816679673462078f17ace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
8292463ba5be31f3022e0ede8013583d

SHA1
e7abdfc8a03ca418baf471934d54a99ed5399255

SHA256
460f8ea9a051d7c7e0c8aa957164da15094ec22d44536ab04ad31a002270981a

SHA512
dd077ddbfabf6eda3845ddcdfcacbc71dceb41924ee1b8d767035ac2fbfc09fe38ed728796bf878e6d08783d516d71d647675200cc67edce5300ab5b12a60faf

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
1493d90eb805042d29a0ce331437e42c

SHA1
e3294c6b32ee11dbd5cf0ffbca99429adfcbc6e3

SHA256
08809a8369e7d7816a841272c7432873d80e9af8b93847f9c989faad4af54882

SHA512
b58f625b6e66394a489fabfa510d31b6d778bbb4996a55a91934f7835dffb70e48d2b2e4ee3d6ae731aedf7cbbf6262943964569f7433a6db52f4c374c3e9139

Download Submit