6d820dfdb240ecdcd9f0491921602e3589a1d3b28ef79896a9fa1409e4faa61a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d820dfdb240ecdcd9f0491921602e3589a1d3b28ef79896a9fa1409e4faa61aN.exe
Size

52KB
MD5

4c5e5c91294f5eb57dceeef6ce3e1250
SHA1

ed052af998dbaebf4390f93f5b5e2f90caf99247
SHA256

6d820dfdb240ecdcd9f0491921602e3589a1d3b28ef79896a9fa1409e4faa61a
SHA512

7d0b3468bb96a692da1d76c1095873b56b5afba287fcf598bf4dea5f394d67ef0d01e2c5483748c5f5a32383fa41b1e790ba2f394bc05c415fb272f093c4c496
SSDEEP

768:/yIzdqqQl/cQ8NLjsUCnFFCWJVBd5Sfs:/Bzdq5W/sUCnCWVdH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d820dfdb240ecdcd9f0491921602e3589a1d3b28ef79896a9fa1409e4faa61aN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	6d820dfdb240ecdcd9f0491921602e3589a1d3b28ef79896a9fa1409e4faa61aN.exe

C:\Users\Admin\AppData\Local\Temp\6d820dfdb240ecdcd9f0491921602e3589a1d3b28ef79896a9fa1409e4faa61aN.exe
"C:\Users\Admin\AppData\Local\Temp\6d820dfdb240ecdcd9f0491921602e3589a1d3b28ef79896a9fa1409e4faa61aN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CloneF_4.exe

Filesize
52KB

MD5
5cc844b136c2c3f7ebf71132d127f5ba

SHA1
ffcf410a54899fd3ef9d50c87afa749155b2e6a6

SHA256
78d9a73a28dd16fb863f0704b63f93fe3f01495dc8921a63f844676f31abc63e

SHA512
91cd19afec2315480e695c9132ee1071c1cb4e058de086c9746ce5f6852cf41d5007200e8a162d2255c7b5462fb90c8fee535e91e23f04744edafe1f708d6c01

Download Submit