edcb20c4866a9bb4d39179a8d8709db43780b82904a02f5fe7a3825f1ad232b5

Analysis

max time kernel
140s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/sqlite3.exe
Size

518KB
MD5

1ffc848ff350e2ee6234bb14a9e29667
SHA1

14d8bb49c895e2646933e746ad2107ddd82451fc
SHA256

fc408d18eb476628686b258120387e3cad2cf85977df4ca9547752a8bf5fe560
SHA512

9ed0c39ae1c9bcf880a5c9e659eb01b85f1887cb1a0982863b52ab931d926c77dfa8b6891e3101fcab7058810a92ab52d55b128dbb8d7ed7f1084d2bcd8e7e94
SSDEEP

6144:BuFI8IxnAyapn4ioYgu5bVKHkdIANuK7E5sJTenZsUzQ0BMX9S09SU6EvRYyTZfM:QFIcxqcpKErNuKw5sZf9/MM92+V/ne

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlite3.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5108-0-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download