68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe
Size

7.9MB
MD5

e9953952c873b47cff46adcaa7e9ae21
SHA1

168a1e4d936bc8b369ec2690ad93d8678e43736c
SHA256

68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0
SHA512

7741f0cae05e4bd190eda4398afe60ba9a86ad633ae59d0f473d3b4e68a0ed4fd7facd6cd255c48c0cb03075a7d2a51be232809c68cd1a5901b760b5ac92d4fe
SSDEEP

98304:Xg49ZaYwsmJdj9PfPHRCjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafD:XgP34NTx9Pe20/zkOiu1f+79YRck

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2336	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe
2336	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2336	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe

C:\Users\Admin\AppData\Local\Temp\68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe
"C:\Users\Admin\AppData\Local\Temp\68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
711caa30161123b6defe6e176b290226

SHA1
a68fd36e976ab6fe06d16de2df9e44bbff254851

SHA256
6b5133b95e33c07dbc869bda0cde8472a9d9caf2853fdd08fe5a8ffd650cedf9

SHA512
cbb3d1be957ca1526f4b44da7d66f29923fe7d3e364f29d488f83761e32c8de8365c48a3bba92bc61b46c6d8a7f299e7628db9a7d65cd430f94e068beecea4ed

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
31007d172b63dbc149ae09589fc7b234

SHA1
db7f0afe009aba33dd29232bad0e095a3b190195

SHA256
6e0ffe2c97b85155256ffc92761c26a0485722da54e9f6270df867c6951940b7

SHA512
d75bf74d99b8459ea316d93f53af360d8f8eb57779148ddf3d5a963e7fd9615d4057cff588d3115a4fc154bad80f82ccf260654eca5ccd1ed87d529c5dd136ae

Download Submit