90cbfcdad5ef720befce0a9662c06fe4fc5b1ac0353d828b0ca6684989165a24

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QQ绿钻免费领取/录象.exe
Size 14.8MB
Sample241018-c84b5avgrl
SHA256 5842dd5495905368d2365dd01d6e5cd223d967ac30de3db041402ca1d507f8a3
MD5 3d3246231b324fc699ea98d8164ec711
SHA1 133e0d6cdde4d68ac082cecea1ed078e7636571b
SHA512 441043eedcc987c0f509523411acb46025a7d496bf6485e0c82cae088ab59deea8df5b6023e9217fc7f3d8bf824e3dcbe2d691da9ac07188c9c44f5a267627a2
SSDEEP 12288:AEvLlry0ZFNegbJJvSFmn+MuZgPSFquOHKTzUAEeSrH9LxVvi1ch:/lrrNZDPcqmzU+SrdLxVvi1q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	录象.exe

C:\Users\Admin\AppData\Local\Temp\QQ绿钻免费领取\录象.exe
"C:\Users\Admin\AppData\Local\Temp\QQ绿钻免费领取\录象.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-0-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/1376-1-0x0000000000400000-0x00000000004AB000-memory.dmp