104368e8c4117fc06be22cb0b4f9812fd61c63eb6baf60ea1eb20009afe215eb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20.exe
Size

61KB
MD5

3d508c5945fef731c30f66d719351039
SHA1

5479849cbfec077a9ab7ec95a7aea886d4d2f511
SHA256

d12cf4a0db4980c865bc583a7106c95307c5c65a2db20a7e9cf33a9701cfef46
SHA512

893aa472a48b7495157fcaae281cfd2325ef3ee18cd36d6589f57a3f3191898b880b3b473261217108b452a986fd30d1a8d1991fe2fa396eabaa4299514ebe28
SSDEEP

1536:iduDFHvo2+1COeZUCjy9dKzohr1kqZ2Pfr8/ZqwmB:UuBPP+1NSz4rBZ23kM

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4372	20.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\4b2be.imi	20.exe
File created	C:\Windows\SysWOW64\lmjteq.fsl	20.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20.exe

C:\Users\Admin\AppData\Local\Temp\20.exe
"C:\Users\Admin\AppData\Local\Temp\20.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\lmjteq.fsl

Filesize
94KB

MD5
fdbeb14d18689bbe445ffb91475f8be7

SHA1
229ef00d199c2627becc1643314db7c71ccaf6cf

SHA256
bff6a1db0e06d3ede71abe21a2c7fbc4e4c45511cf45c8dfbc10a50021f127dd

SHA512
bb5e4d91dbddbd053c2593f372f750bc55c0acfeec62f14f40f2761dceb1877057d73a06054c0e01e47dcf9aa548b401904def79697d64a18e231978b21c47b8

Download Submit