68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe
Size

7.9MB
MD5

e9953952c873b47cff46adcaa7e9ae21
SHA1

168a1e4d936bc8b369ec2690ad93d8678e43736c
SHA256

68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0
SHA512

7741f0cae05e4bd190eda4398afe60ba9a86ad633ae59d0f473d3b4e68a0ed4fd7facd6cd255c48c0cb03075a7d2a51be232809c68cd1a5901b760b5ac92d4fe
SSDEEP

98304:Xg49ZaYwsmJdj9PfPHRCjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafD:XgP34NTx9Pe20/zkOiu1f+79YRck

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
3044	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe
3044	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe

C:\Users\Admin\AppData\Local\Temp\68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe
"C:\Users\Admin\AppData\Local\Temp\68adc3df41a4893895603457d202b26f5de7178da1c9263ea56715e35e1f75a0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
51c053f8727db82852313f09b942e175

SHA1
6a9d23217f8cd7aefa6ba06b1dd9619b01c277d2

SHA256
0e963da3cf104031d561f0c0f235361d08fb131740c5d357044662d86cc3f552

SHA512
4c06150c5b62647d25fcdf4aa9a6819460fc6644701fc94a0176962b2477c8621f4250d806a167d4e182e8ccb612943fe6b54afdca516d7f8b8ca718ccc43869

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
633b395a805ad471891892b68fb3a83b

SHA1
c67c9a03c5797e0b6dc5bba381d5c93b998df3d8

SHA256
835711f57e870b11f9731c36eb34510e9823eecb8709639a16c38567732ae773

SHA512
bd8dc68d2833ef860cf56287c22929dd8ded2fed6e0fd4138addea6420d6e849af6a62a9e1e70d0e4f4a174641f5dae8172ae30f13ec87bbf4e9b3d155465e18

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
6f0654cb5627f19c2458430a28fd5bd1

SHA1
e5117d996ad92c985593811ae214f01c74a79701

SHA256
d2d82eec9495ecf8ce5bf729b62de1e73e010186a817dde6029322ce43478866

SHA512
22a0e37711d2600bdd07b7b9d6a1ac31508a770dac47a208ec2f255d511959a3f3c85d2d0ce80cc6383de186038739331ae21465648fc85b19d19ba03631f0ba

Download Submit