9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282.exe
Size

11.3MB
MD5

559695cf4c2fc926b32f6d4faee8e43d
SHA1

039965be400b911175506c21362e3463b789fbe3
SHA256

9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282
SHA512

7cf192683eb1b565f6f8cc65e7fbd207379da447a4e2329b208f28d8049450d821ace60f166b7fd3c8bec46fc1a22311f68c01dc31c5c4b626a56ba78d787587
SSDEEP

196608:RXFGPpySVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:RXVuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2880	9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282.exe
2880	9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2880	9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282.exe

C:\Users\Admin\AppData\Local\Temp\9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282.exe
"C:\Users\Admin\AppData\Local\Temp\9fa01469c9a25c199b40b093f58cdad953e5858e6c15d3992ecd216c83037282.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
5b7cd4466aa6115a6152079c454cf1af

SHA1
bdb7a595ea18297562069d6ef70dfe1f3c85ea8c

SHA256
307ee1cb1a1a1c55fe69b15642c63f946708fc516c46e3719c18f2da85bac836

SHA512
35e9a1fc5c9a0af643f1c1358585b324c97529f2ca315beef82152446d0946e8d6fdcdc615406b174dbb6c9f2cd0cdfdbae642851dda9bc79a0bb88c95f62017

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
e0e12afeb051e1f5f651878864e549f3

SHA1
1dd5886f5bc1307d11bfae92c098c0390349e7ff

SHA256
cafd168e8cb4081f6523883e6bf47b9e246902844da63ae7da13902eea4dac36

SHA512
316dcd1e5290ead0ba108c35d0f7d7a4c8d57e307995c8130a16f1c357e372d8b4ca0de94c4b56424a08a6e34215d802d0845cadb3c525623ae0c46d88526dc6

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
88714d2fda650a8bd45adceeb23d64cb

SHA1
34b70bf1871a2514e08729bb7cf92a7114854295

SHA256
4c9ec94e7d9f9eb2f0b5a4fefc4b29ecaf2103fa49ce6dd1c095679dc133d755

SHA512
07d06d4bad3711664d103b14cd940ee6b4b6aa38c9066d681d3d5ce1574d5dd912e2089999ae5ed398bc4c86d722f292fe2217064b445084551b762960b10bbf

Download Submit