e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
Size

10.3MB
MD5

2c6e28a55e0519914599ebf0f3bfa096
SHA1

618df8384bf14cb25af29c1f194fce1fc20cc304
SHA256

e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a
SHA512

d31f00c5feaf6accbb3a5579090b7ad9f79f057e6e9a409cac5df1d83b7be69b84b939230b337d717389193b74ed31de05ec5a8e80dc7f5407f8e11f5f1e76ca
SSDEEP

196608:dXHSVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:dXHuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1548	e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
1548	e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1548	e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe

C:\Users\Admin\AppData\Local\Temp\e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
"C:\Users\Admin\AppData\Local\Temp\e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
24c5d29b3a1c5630471ed7c2f8cc8a46

SHA1
3ae4cd9a4a02c08b81fa613afc6b4969e9d95d1c

SHA256
162d8b7d11ce9c424d57e20106902c064a2af99fa52b578eac481a79b71ff053

SHA512
e26c9d902dccfd70da78b28660c9afcfe22bef35960a60efd522e5ca266f3ba9f4cff3d11003b175a9c54521618d04de0ad0bf01c6e0ba4c86e5c24d4b2b266e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
1409266f9e9853e84464e70e7c7702a7

SHA1
3d441f2ea33c8d3197d2738bd5e7297958b51243

SHA256
393c1d5ea98b20e31596f379cc2807c54965ff75d6a6332a8ad2e0b506ab95fa

SHA512
9891353262e39eae57a1ef0e7e54948010822bf8f427ad4f542b0d5a9961dd6c92c56f9ebef37404197e7cb742c963c1b9aac4bf415f4548bd9e8741ca828c4e

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
952b5baa96952f7c1204bb2b6f5d9b55

SHA1
de55fb69a91402f3887e467a9f7ee191a9c5a1b0

SHA256
8569ff65e0dd9bd08968ea81ef65d84863f151adebb21e3f159611b4adc91dd0

SHA512
8a6fe904ac34ffe0fd63e2dbbe4df0b6cd408ce4a9edac7ac91c490854c63fda9d4378ae8001fa3ab81ab2642fa4c472553e07a9c143e614f046389034ac982c

Download Submit