d53caac93f030ac098aec24726cb8b79e973eb2a7c2827d0512862f034b2287a

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d53caac93f030ac098aec24726cb8b79e973eb2a7c2827d0512862f034b2287a.exe
Size

8.9MB
MD5

aa0b87b98cace82598400ead5e9b14e7
SHA1

92f3e746b613fe6730f7be8d806d2401025d363f
SHA256

d53caac93f030ac098aec24726cb8b79e973eb2a7c2827d0512862f034b2287a
SHA512

b244f7745f548acb6e994d8fb796a38fab803c7cf26d2a1974df1a24cb9f9467cff3b4f7e9eab7d7a8779a6b924e44fe80a79c2339fc291591b9472bfa9f3407
SSDEEP

196608:ZYPRWWv9RZ24NTx9Pe20/zkOiu1f+79YRCk:ZYPRWUjQGdCzkOiaf+JYRC

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d53caac93f030ac098aec24726cb8b79e973eb2a7c2827d0512862f034b2287a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2068	d53caac93f030ac098aec24726cb8b79e973eb2a7c2827d0512862f034b2287a.exe

C:\Users\Admin\AppData\Local\Temp\d53caac93f030ac098aec24726cb8b79e973eb2a7c2827d0512862f034b2287a.exe
"C:\Users\Admin\AppData\Local\Temp\d53caac93f030ac098aec24726cb8b79e973eb2a7c2827d0512862f034b2287a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
bfb0fcc43e8404696c0a4995063247ae

SHA1
b27e8f22dfcecffadd8a2ccdaf11e17e6495bab2

SHA256
c70e5649fc2c06dc3f96db5171a23a9b7071917da19a7be579ffeac95be7d9a2

SHA512
120cdcd4178307d59fe039b3b8205eb6cde51515787061476f3b8fd5997ae90b22fd4eb8cab0278e05719d98b6ce636272d755e54db3183e6862c92f6b9b9eee

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
1b22fbd4e3dbe408a4b45bac40dfc9e2

SHA1
4c8b4fd38a9211cba2695a4d4fe1e487cee67c08

SHA256
2dd1e1f5290c83b8d93abaf4dceb7de2eebce9355f6d3e898feeaa2ac8b92b16

SHA512
41e4190d24e334b461a6623d5146e4034134720d2d23fc0978e8353814d82446929678532f7060f997323cd764bb91b9b47d35220dfa7658bcd26ed46a0b0694

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
c582f0d31c4302001ac75a4852b35ebe

SHA1
3c53cdcd3b53038ddb54774b69ba0002ed989d7c

SHA256
333232eedfb2b73312bb05b0fc82baa3026d27fde120b858c2174f937b51e558

SHA512
bbe13ea6d12e61e3cfa2ab5c18d336ed99382c47d46310e4421f0a3fb43858eadf20b26a0da7ff4a0531eb41eebee65c9b1a50bda9dfb92f5a018fa3c2dbb90b

Download Submit