18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76.exe
Size

10.0MB
MD5

042deda426d2c711aa38a0f73c2599b7
SHA1

c3afbb7a76eeca435fd38ef7bd7e5d49d89de48d
SHA256

18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76
SHA512

15196e1e0b3bd2130e7219153e63b6a1ad2c674785863a268e8716e0d0a03182b8f336c23450c40ba91b08dbc19ce34e30118971237f1f931da139f73fbdc2bd
SSDEEP

196608:arS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:arRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1320	18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76.exe
1320	18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76.exe

C:\Users\Admin\AppData\Local\Temp\18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76.exe
"C:\Users\Admin\AppData\Local\Temp\18cafcce0a0a953f256a79848c8ffc7ad85894b726647e9a502f1f25125c8d76.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
98c0456bf2483826882e42bc7937c88f

SHA1
0d87e5c0fccb8dd1b6fd8ef4baceb03e8382b902

SHA256
37d0182fe94369fc4fb542362c1d0937069bf627eee9e1229aeb18f2552805ab

SHA512
5dbbf743b5350d5f2d74b774243cb10c41be89d6e7111b4cf2813f82d616944fc4e26a9ec72815031e360023fcfd4090148769a0af6287c67e1c2317284af458

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
76c97f82afa9dc57fa0b3b731d54c819

SHA1
3da1bf1923e805222c67cbfcbe31f3cd154d9e71

SHA256
f40ce8268e0492d0a4ba0032c08b755568d15291a30ab80142e236acb0a5d0a6

SHA512
bf6e19880d765cffcb647b593d50b9501c0b5617393e344a12554d8ebad3a4420379ee9145fac629a573b5dc07918c3e45ebef10639bcab3f465144f7450f915

Download Submit