38f343ba44931b5ad38c3502b01451967f254bdd5683a808d36e60e0116ec97f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f343ba44931b5ad38c3502b01451967f254bdd5683a808d36e60e0116ec97fN.exe
Size

139KB
MD5

a8d740d488d2f86a9a1dfb8e19670db0
SHA1

ee228d66112a020745cb7d85bf1d7b72f01e39e4
SHA256

38f343ba44931b5ad38c3502b01451967f254bdd5683a808d36e60e0116ec97f
SHA512

4808506787bb3e6c97d09d0138e2fcc8d12f1eba082507863c6d49a304c0ad84a7174c064baeaaf1db49e0a11895d480068ea3a4f7ca282a20bfe4314d94f24b
SSDEEP

3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/0/Fnncr5:hDeM7iNEkgiOb31k1ECyJq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38f343ba44931b5ad38c3502b01451967f254bdd5683a808d36e60e0116ec97fN.exe

C:\Users\Admin\AppData\Local\Temp\38f343ba44931b5ad38c3502b01451967f254bdd5683a808d36e60e0116ec97fN.exe
"C:\Users\Admin\AppData\Local\Temp\38f343ba44931b5ad38c3502b01451967f254bdd5683a808d36e60e0116ec97fN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-rs0Mv5NJW8FJXzsK.exe

Filesize
139KB

MD5
ab2e05fd5e5145ca5b95dd3d3bfaea3a

SHA1
736cbb24831e7369c9290bd8879cebc39e013e2e

SHA256
d51abfb506ee8da572e20eed3b7ad5d18e44e72a9ee33703cd08c2cae1c27105

SHA512
e734a4d988752e99ed1a3a4c2809b63596043bd0301efdb261161bfc2c02eb3565c801d1ecb0dc3f0d408f2f7c833f4d0a240b7a274adc730e1d2199d3c78d0e

Download Submit
memory/2112-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2112-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2112-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2112-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download