d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe
Size

11.3MB
MD5

331f85cde8d6ee5b63f77f4ead19fd20
SHA1

285631c5a31bf2c9fd2741fcdcde2b34c866132c
SHA256

d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805
SHA512

0cf025479438c27b81ddc570e8829430f5a926baca3071b354561737def2b54c2bad32120c7cd73b03815f30cd0e65a6bbe9d010f0e442102bede05a3ef68d2d
SSDEEP

196608:RXFGPpySVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:RXVuf+6poDjBTRxa8psYSUa+arvSP0z

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2816	d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe
2816	d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe

C:\Users\Admin\AppData\Local\Temp\d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe
"C:\Users\Admin\AppData\Local\Temp\d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
155f51ed1d65399834b60d543b90da9f

SHA1
725b91311f674640163d3fef67ec7968735cde50

SHA256
5506ab3d0fb1b8d0a8c7fed3a0c5445b52c5776f3e98634646868e974b7f1e30

SHA512
f31666ef33b571376162136b25352f686133593ac0b2153239f6fc1ae35fcdbbbc212999c1ecf223608a39d4b19f720595ff330456f1a098f1c3e91db4fcaa81

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
59b5c5e2132568ebe3f4e44e5528a60a

SHA1
6837684388f225f1d549cb05a18c865344033dbd

SHA256
bd08ba64409e517257ebbaac8e0b9c4dbfb2170dcbc8e4b481400553f0566577

SHA512
1a47f5adb8f0c80b9c3ab951a17a7310beb8ef04884fabbc60592bf49997029f62ede097f9c6e050ceba27c6e85a36f8dc6394518ad062ee9f5d06a014838057

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
7ce4c2cbcb72adb940bdd9d10f68a26b

SHA1
5f2eff0d507bcdb23c7abbfa6f7346ecf58a4779

SHA256
d1ac0c521e838b664548ecd4ad52ae1f020799214399202c51751a88e85093ec

SHA512
7f8558168cc0e694446bc531dadba15a1791760447636a3267009bdd611713d0fd8a2b6141a47bbafae2cd079b6b30363375d6110cc83443e9fb1a8282770007

Download Submit