d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4.exe
Size

11.0MB
MD5

6a0d0f27b978897de133f8adb24903c9
SHA1

4c1c1869827ba6c5d791eac5d6f9f2a91169634d
SHA256

d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4
SHA512

85a4ef755284d2480f06214dab1c5c8c2452caf284983956c206a276f334385c78810f8c4fc03ed5a5f8a2aef59323959ae9d03af61903abdd9711918a50c3e4
SSDEEP

196608:5lAWWOUJYS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:56WtUJYRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1548	d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4.exe
1548	d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1548	d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4.exe

C:\Users\Admin\AppData\Local\Temp\d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4.exe
"C:\Users\Admin\AppData\Local\Temp\d12b4187a51213ac84b836741873e4ce67b6ddcd173b528bc848b5f629b9dac4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
84154db79ae816ee82a451fddcf974d7

SHA1
b1efdd47bc13fd5aea166907562efff981561cc5

SHA256
205a90c46bebb07c89c41fea056d4a58346b40491c0a8ff31461260dca7d8d31

SHA512
797523eccfe3252eb17a94ad99540026c1e60505a551bc1be8f1217de910aedd117bfcc6f65e92cf8dc38ea0e9f63f81ee4a147eefc1308595cf2b3a4b87a535

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
5a2df507d78798cfd310aa6ae32109f3

SHA1
0d9a725acbadbdd8e784caaef32d1c5d4c2c916f

SHA256
a2d8d9085e469004ce85b6ae9d820b34e1b8c50fb77d1336db9ae410f3d991bf

SHA512
166bde67c9e6847ee7b69c2760f79d99aec2eec38ff5d159121fd7fb755ebb94bd4706b6ccfbe681183595db2d7ba2946acc27ca98bd45f7d07c93870a3be7a3

Download Submit