36ebe39a6a6e102d669a588cf3a55653d0c70032cbd648da0be2fc6ca1437784

Analysis

max time kernel
94s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36ebe39a6a6e102d669a588cf3a55653d0c70032cbd648da0be2fc6ca1437784.exe
Size

7.9MB
MD5

1fd3702034a0519bfcd339b67de50b7c
SHA1

f5751af1ff958cfcaaf7c186944b0fb82e01985b
SHA256

36ebe39a6a6e102d669a588cf3a55653d0c70032cbd648da0be2fc6ca1437784
SHA512

185b2d83b77e3e674c84b08aacbc43de2ddc7752562b6454b993b3b6500af1150ea87c0249e089e303ab4208ab8e408bc62fcb7a37a417a421c8a1ac7617e3bb
SSDEEP

98304:Xg49ZaYwsmJdj9PfPHRCjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafD:XgP34NTx9Pe20/zkOiu1f+79YRck

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36ebe39a6a6e102d669a588cf3a55653d0c70032cbd648da0be2fc6ca1437784.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3792	36ebe39a6a6e102d669a588cf3a55653d0c70032cbd648da0be2fc6ca1437784.exe

C:\Users\Admin\AppData\Local\Temp\36ebe39a6a6e102d669a588cf3a55653d0c70032cbd648da0be2fc6ca1437784.exe
"C:\Users\Admin\AppData\Local\Temp\36ebe39a6a6e102d669a588cf3a55653d0c70032cbd648da0be2fc6ca1437784.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
e30f25c0a03850e2b7b885a14550bee9

SHA1
d66c95c6d5aaec57f305b12da92e92799192427f

SHA256
65f9c2886e956271b8858e73f7edb48e4f6a2a8d0f65ff5535aaee9f351501b9

SHA512
a97018979fc8ee99bdcd15f3d425c7f117e1044a374772aa99a7c7e8129dd11b8818c39c331f96c7ac446a3b5af1564f4e3165e68a0bfbf0b88155c0403d9503

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
8c411abe790ee4ff1788d89bbf9e949a

SHA1
a49b4fb80bef71c64838f92c7faf44b54425cd73

SHA256
c558c2c98939d5d92eb500e507d63da3c3fff6bb406d647cd60f6683e91c47e1

SHA512
e5fedd4f37a9244a8b2084f128d96e09ac73314be24f0ca849a448dd37efafef33e8bd77cdcb5035e8fe2f16f278d1b879a0a43cb80faa4e4f0dcab6c14ce773

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
f0f1ef9db290245655a4ed02e70833b9

SHA1
50aafdab76eb1dc43b7ac5edee7ee174a50fff8c

SHA256
141ed019b9da60359a0cce7efcc04bda7b2744c14b31a46c9a808ea2cddcd119

SHA512
917352e0596c6bbee095810e808f7943ea6a12b11301c309059808938e319ac0d3830801dda530152551e9dcc04c4cfb438456c7f7f3b19889e73ae1bb15370a

Download Submit