e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a

Analysis

max time kernel
93s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
Size

10.3MB
MD5

2c6e28a55e0519914599ebf0f3bfa096
SHA1

618df8384bf14cb25af29c1f194fce1fc20cc304
SHA256

e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a
SHA512

d31f00c5feaf6accbb3a5579090b7ad9f79f057e6e9a409cac5df1d83b7be69b84b939230b337d717389193b74ed31de05ec5a8e80dc7f5407f8e11f5f1e76ca
SSDEEP

196608:dXHSVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:dXHuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe

C:\Users\Admin\AppData\Local\Temp\e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
"C:\Users\Admin\AppData\Local\Temp\e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
b1e11d348ed71a6d880f4380099489a9

SHA1
9f5a1520ba842a6617741afaa53abdddb4687d96

SHA256
5bf6309a84ea3eef8e6a5fb8bfebd382858c232bf0d175195c8e3dd010dc55f3

SHA512
a990b3800c0f482f6e3b6442cc670cdf9f68dba91f2f193e25ee72c0eac8907d5c864d1bf22c7f8e0b20207c1bdaadca2335029da0ce939a2e8b1cdfdacd930e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
49468bf44e98cf16afe25e7b771bb5c6

SHA1
c6f7f58adac614542b29028061805da023f82fc7

SHA256
a48294bb2266f2efe520e5201227935cc5fca567dfb2cd551930002c9b6bddfa

SHA512
f836c73db5e8a080a268ce85e707bed318b75f04d29c168d8b6709a0093198ffae8fadf4bcc6968bd4b26780594b76b355abafbb5946695234a080e1ccfb302e

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
6508d209a4df9e49f892899390255d05

SHA1
49f985a4f25bf70b260707de2a4b22b21d769816

SHA256
ab6edb1e3eeb82bebf88f1f87d4a2af7b91679331b239cddfd3d3692b0bb0f85

SHA512
d65d1f9ed1ba10c1b914d7d7af4273ddccb7d5c3ef1b7fea5cc1368d5eccd744b8d312fd388b7c065cf2d34efdb8e15c97c2fb52460d632cbede251e7ac56dc4

Download Submit