0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa.exe
Size

11.3MB
MD5

e3f1c3b9bad4e6eecbc15248a9a3f5f1
SHA1

0fb5c0eb3afe5dca042d110562d0da698931382e
SHA256

0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa
SHA512

a8f66c9d9b385a253eab919966ea789d4f42956241779b31d8a43f53ecab001d41a370934c704d63e00561708a6d2d04697c76ed65013e049b20453fbbcec7e8
SSDEEP

196608:RXFGPpySVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:RXVuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
804	0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa.exe
804	0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
804	0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa.exe

C:\Users\Admin\AppData\Local\Temp\0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa.exe
"C:\Users\Admin\AppData\Local\Temp\0d0b90fa283b546352f20eb814543d2e6e9e0391044499712140d6eac8b59aaa.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
0a83852332aaf632ec111b4a48043a37

SHA1
c09ec40827800158f5dffbdb412d8ae93076df02

SHA256
fe0643fe81e7a2e3781f42f82025c1fd22537fed4d98ce65ad00e7fe7cc63f61

SHA512
fe20baf26b9f602420de37ff77bceeda368a80c97e6a74a18563437c65159a9e490e73df74d33fe7e1ae0d05e26991efb2d879f218e976b88abeef7bddb1184a

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
fd669018b89effbc3891551ec557638f

SHA1
e2c96f36a08492468c6de50018ac868d1334e80e

SHA256
d3f3cdfe4d3d8354dcb79fb71121afc33327e053182ceb1a0d6f8a247c0a8e77

SHA512
3e64b030d49a7226eb358113bfb227755dfceeb2bae5d8033668ac352e565ac3f0f2c5bae61917c443093e24456558b128742fe78b2ba18043fa02b33330dc8f

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
3d324583773e3b0aa2f9bda534925a0e

SHA1
8c73e40884f024a9dbada1fb0b4a321199777da9

SHA256
04e5088a878f189a0f4043581c5fb53a1b729609ce41e3ba85deae0123dd0b87

SHA512
c967431d854815a64cd3e618b7cdfeebd0c9b88226cb3fa78474f4397116ed7359611cac10abab388d192244d8f7f197e1f19bfc5ba0c2c03ad2432e9841f572

Download Submit