41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e.exe
Size

396KB
MD5

cc94be13bc24599e326d03ca246a61fa
SHA1

73ed54a021153213ee4823683e4a9376b479d939
SHA256

41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e
SHA512

b2da25e014462b410d8a68dfd09c0159772271b7f706c95ab2ef517060dd5305a02b49ac021a80d9c21624c8c02bdde9b62be9dcbace2308802edcc3a336b125
SSDEEP

6144:bXqwxGuBem9P3ofEPGc8V8vkl4vn6QdG9eB4RyWTkui4ZR6d0psZ8EZ:bXqGGTvNUw435B4pZR6d0psaEZ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2088	41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e.exe

C:\Users\Admin\AppData\Local\Temp\41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e.exe
"C:\Users\Admin\AppData\Local\Temp\41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\msvcp110.dll

Filesize
584KB

MD5
54b8f43259c486d87dbb9b4b4a71014b

SHA1
373351ecc936b3f9dbb2c858cd0342ca7af807e8

SHA256
6cf354d8c07b353870741c6c53f467743e214b4d170e92316d566b555268a44b

SHA512
9460135d568807652689189cf3fe8c8b641c0e3b7582f6f9dc35eefc36b82312fcdc9c08f841024717f62f23160b2cdb6ac3b1eb3188029656a7913114d354c2

Download Submit
memory/2088-0-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x0000000001150000-0x00000000011BA000-memory.dmp

Filesize
424KB

Download
memory/2088-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2088-7-0x0000000076DA0000-0x0000000076E61000-memory.dmp

Filesize
772KB

Download
memory/2088-8-0x0000000074910000-0x0000000074FFE000-memory.dmp

Filesize
6.9MB

Download