d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805

Analysis

max time kernel
94s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe
Size

11.3MB
MD5

331f85cde8d6ee5b63f77f4ead19fd20
SHA1

285631c5a31bf2c9fd2741fcdcde2b34c866132c
SHA256

d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805
SHA512

0cf025479438c27b81ddc570e8829430f5a926baca3071b354561737def2b54c2bad32120c7cd73b03815f30cd0e65a6bbe9d010f0e442102bede05a3ef68d2d
SSDEEP

196608:RXFGPpySVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:RXVuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1008	d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe

C:\Users\Admin\AppData\Local\Temp\d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe
"C:\Users\Admin\AppData\Local\Temp\d6f51111ec28c5029c2400036f8f524a1f8ab34872bcb91b44440d95e166e805.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
eafac5ff2fd6a6f3443964aa30c9c061

SHA1
b3f3c1cdd70e24ce806e570309b3d7b5d13a8a2f

SHA256
217bd70d624821c73ad09aed3ab17482739a5557a18408cb66e9a0c92ad7722a

SHA512
bfcef24b69741af3f6c2af49b876e74fafe997b93aa88bc32c39afc201e1d2be0863fc90b2376d0b48b81d4454d5fc1c1dd33ed207d303bc6854fbc05a87d8bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
2296bd3f0090aa0e6c21721962513334

SHA1
35aad603ba8ae968449e42f4faade5acfb5c6d9a

SHA256
b2955bd005fb4892e278fe4524cf24900ead3b0de8624d4271fd54e888354564

SHA512
513572edff9d72ba6fe0e50f1b4eebe06e302a03ad21a4e78e5faf693a43c8410d6ccb8398c7ee30e81b6271e7325c2b0938dd7db52e98345bb836738be8bcf5

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
435dbb727d233b60c05684c3002efbe0

SHA1
d1ac7cbb9e8692d94761aae28b0740788d0732b3

SHA256
2c357162b729bc8309280b78ad842757ebee36b2ea41bbdaa6622d6437619193

SHA512
746f44f875988f950f0b28abda130528cc67c6272d9d190ca08094b871d1a5bdcbccef42872729fc313c88d941f1d51ef37b12e81421e30c666f817bf8e012cf

Download Submit