8d9a38a383bb6b3ae1e1c8133a2c73f57c2d6c729343a60d602d7f867431535d

Analysis

max time kernel
16s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d9a38a383bb6b3ae1e1c8133a2c73f57c2d6c729343a60d602d7f867431535dN.exe
Size

788KB
MD5

92dde9bef68f19e4d8f5a51c1acceb20
SHA1

4ff20121b3b69b596fc5624d4e35475ca7fa0c4a
SHA256

8d9a38a383bb6b3ae1e1c8133a2c73f57c2d6c729343a60d602d7f867431535d
SHA512

0a0190a2e8bf67cb380f53738d2b9caa6acd1115f4bf5c73b81a72fad61ebe4495d15769ffd7e272313f04d3fb4e1a6ac94f903de380a6f2da14784291fd2170
SSDEEP

24576:BwoUgUgjZR8Umuz35kXKCbOoQ8RT+mAL+xUlTFNb:ioLZjZdmuSpbQ8RT+ESH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1152	8d9a38a383bb6b3ae1e1c8133a2c73f57c2d6c729343a60d602d7f867431535dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d9a38a383bb6b3ae1e1c8133a2c73f57c2d6c729343a60d602d7f867431535dN.exe

C:\Users\Admin\AppData\Local\Temp\8d9a38a383bb6b3ae1e1c8133a2c73f57c2d6c729343a60d602d7f867431535dN.exe
"C:\Users\Admin\AppData\Local\Temp\8d9a38a383bb6b3ae1e1c8133a2c73f57c2d6c729343a60d602d7f867431535dN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oc_B71B\OCDLL.dll

Filesize
1.0MB

MD5
f37f04a7e571b994a593ccb748229824

SHA1
18963428579fef18869dae829847e58b291d354e

SHA256
7c19c355b33b2cbeca91eaf43d9882e28e3d5c78612e3bd832b8f6d5e437aa04

SHA512
f8808ffc9bef8b4f8c5475b53561220da7d86b5d0b73e555f3a5fbb66b574796ebd75a54fea909549fa93ace557239881adc21a5ef03e62f98908c80bba75033

Download Submit