795380ada0e3872472e012949ef6cda38a849b7f44133f14986c0f6b52985046

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

795380ada0e3872472e012949ef6cda38a849b7f44133f14986c0f6b52985046.exe
Size

10.3MB
MD5

773f3ee0175b6638ed6f0ccf4b5cd39e
SHA1

e266ed08daba5247503384d8e0c86450cbffe2a5
SHA256

795380ada0e3872472e012949ef6cda38a849b7f44133f14986c0f6b52985046
SHA512

5a0ab56aab1262f822363c89ad2d6dd61990b9fa839ae0484b525b9c1381cbd80ae53c34a44133907423fa1683da90bb98905bb0a975cd336639d756b92f57e5
SSDEEP

196608:dXHSVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:dXHuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	795380ada0e3872472e012949ef6cda38a849b7f44133f14986c0f6b52985046.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4792	795380ada0e3872472e012949ef6cda38a849b7f44133f14986c0f6b52985046.exe

C:\Users\Admin\AppData\Local\Temp\795380ada0e3872472e012949ef6cda38a849b7f44133f14986c0f6b52985046.exe
"C:\Users\Admin\AppData\Local\Temp\795380ada0e3872472e012949ef6cda38a849b7f44133f14986c0f6b52985046.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
4123d01d9f0bd785508f8e38307eb1df

SHA1
528e08d571df884638da2fab27d32b1571a4bcb6

SHA256
5ff2f32ef0c71e35fdb3cf2ae9aabc67b5ad123aae7047ca9681e86e37079a44

SHA512
8a633bc67688e9cfbcc25a2bbc5141cee516786d538d60ae2ac51d22a30d9a1d3b2adda3be2612db78031a1f06752ec49c880dfb6d77dea52bdcec3c7742f77d

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
52021a206d9aa278b927d3b022dac00f

SHA1
67bcb33118a04bbe91ef49958117d96f4c5749b3

SHA256
f126ab0195ea2eea1e1b2c2f8324b9a83091fc867100f82692c4604eee7eb7cc

SHA512
e9250cc52d8c65329b6ed23f7c3574d6b5d3b607b7196e09e0708f775ed1ef57eecdf1e1d6a41f9126bc85a56077fe53b9744eb9fae08613d72f1e1f843b5124

Download Submit