314166f9dde25b13c5cca86e65a67b26dbae5dcf17dccf7c5a5eb21d3ff76316

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

G K M 9 5/GTA 5 Mod Menu.exe
Size

312KB
MD5

46796db8acd3ff52d5daa757a0acc12d
SHA1

090afe3863790f1e8d9420309538aa5fa846b29d
SHA256

b38f4158c414aace2b77f2743822d2b05b1b456f4b339192c48804fdae25a184
SHA512

5b3647b1f2963177513f5a336563e3a8563fe4e6d1c8e00ad4e554f298fca03c200f99a384b24672daed897bed9eef15442dd99afacd5e9992dd27d053f151bb
SSDEEP

6144:z6Tz42be3YdQ69bI3aG7ziKyTcQsH9nw5DIOoUX+WXvC1OELkRue:x2YYdxbjPKyTBsFUMJUXf5ELkRue

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1756	GTA 5 Mod Menu.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA 5 Mod Menu.exe

C:\Users\Admin\AppData\Local\Temp\G K M 9 5\GTA 5 Mod Menu.exe
"C:\Users\Admin\AppData\Local\Temp\G K M 9 5\GTA 5 Mod Menu.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\msvcp110.dll

Filesize
572KB

MD5
1a3e6dcd6b446b86f6cc2c11efe0bf35

SHA1
39d1b7a080d0d8149b68ac7a459a7b8d512204cd

SHA256
d64e6e381b5341fd164b2bd8435dce7db1f622ea947242e96ba5696eb0095b5b

SHA512
769982e0c23aecd622c6efd77773c8836325fe3a71e9e8cc33cc956e4ae23811f1a82d8dc7406a3fc3405b83656fba670334297f3414d0f708d8438d85112814

Download Submit
memory/1756-0-0x000000007473E000-0x000000007473F000-memory.dmp

Filesize
4KB

Download
memory/1756-1-0x00000000013B0000-0x0000000001408000-memory.dmp

Filesize
352KB

Download
memory/1756-2-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1756-3-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1756-8-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1756-9-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download