33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003b

Analysis

max time kernel
110s
max time network
91s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe
Size

139KB
MD5

c85992c2edba8f6cc9ea25d490349370
SHA1

2019586d054c19db2c2e9a55c0d1a6b6ab596069
SHA256

33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003b
SHA512

0e29c03a58199424c78c50ececa55588c638f2682bb50ba1cd43b0e182c8effbe5fac09d84c561326770950d1cc3550cf6b06d7be628c7d40fdf663b2328bce6
SSDEEP

3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/A/Fnncr5:hDeM7iNEkgiOb31k1ECuJq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe

C:\Users\Admin\AppData\Local\Temp\33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe
"C:\Users\Admin\AppData\Local\Temp\33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-ioahseMwRKzifEY2.exe

Filesize
139KB

MD5
457a527b2a9f946a9e5732a2a6f83d21

SHA1
22fb65355db1aede82980339a9ea796476c9409e

SHA256
82026ced49c5b1e726d5cfc5d66f16b94cd5906fdfa83c8dac65a5088c914984

SHA512
3cb83f56b619bcb23c7c7feb1cc4284f1e2705062711f603fef0b10980d54ac2e741c24856525ccc43c90e0131cf589383b9abf0b05a9592ab4ffe92d494a617

Download Submit
memory/2300-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2300-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2300-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2300-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download