33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003b

Analysis

max time kernel
111s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe
Size

139KB
MD5

c85992c2edba8f6cc9ea25d490349370
SHA1

2019586d054c19db2c2e9a55c0d1a6b6ab596069
SHA256

33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003b
SHA512

0e29c03a58199424c78c50ececa55588c638f2682bb50ba1cd43b0e182c8effbe5fac09d84c561326770950d1cc3550cf6b06d7be628c7d40fdf663b2328bce6
SSDEEP

3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/A/Fnncr5:hDeM7iNEkgiOb31k1ECuJq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe

C:\Users\Admin\AppData\Local\Temp\33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe
"C:\Users\Admin\AppData\Local\Temp\33dbe753c09a772dfc87c6832dd54a79c124396c86989b1398c185cb950a003bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-R6AWUsGgEHNnhrFF.exe

Filesize
139KB

MD5
005e900839f55930c21e023b3a2ccd1a

SHA1
f834d69e52ca8f5ce7742cd5624370ca5764e07c

SHA256
2447b0d8a2017d84cc814ff1d0b52014987263c350ceeb40838fe8b401c160f2

SHA512
f67c0be9bb9189a3043dbd0d2c232a71c63e121182bf79ccee69305ae1aa85f497966e4853e579d8cf3ac9233359f8dc4ffed6880ae5b41fe5a85cf491decedd

Download Submit
memory/1576-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1576-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1576-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1576-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download