842e2bcd8f9cc4479d129b390fc81b3a9c8d0921b907fd0ba10ff802835b66d8

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Size 2.2MB
Sample241104-fd1jjatjay
SHA256 fb8c862b1e2c2f423dde036b9d77f241951674dc5e6ee51954f2b37e19bca378
MD5 fc610b497818bcb5249e72410aed5162
SHA1 3da9e3fef84300fbda10fdc9e97250d1fb4367a2
SHA512 4f23bea8ba7bf51dce14437fe5209b3b3209c1d6d7f8912fa91fa734a98cb92bed129cdee8ebfddfd22fcf42d90b5944e5d64e026ff531527b705664fab8b3e4
SSDEEP 24576:x1+Sus1HRBOcDtwCpFf4fMaJj8C7hkEcw32Ig1BJS/AcOWdg0DZMK0jwUAHxala:NJzVAjj8uo1nSocOsDZMoDHxk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FSCPlugin03.exe

C:\Users\Admin\AppData\Local\Temp\FSCapture-10.5-CN\bin\FSCPlugin03.exe
"C:\Users\Admin\AppData\Local\Temp\FSCapture-10.5-CN\bin\FSCPlugin03.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-0-0x0000000001980000-0x0000000001981000-memory.dmp

Download

memory/396-1-0x0000000000D40000-0x0000000000F76000-memory.dmp