6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe
Size

5.0MB
MD5

6603942b6649f4e74372a51a0758f231
SHA1

1d2aeaf82c3a661e169f97b9ad27fa5f28493fb9
SHA256

6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74
SHA512

22b17bf8de7079faf842679d0bd60b8fdcf01504dc98735c73687bbbae1090fc1b420dde30e8d4817c55542b2b3252c761d4297310001c0601aade8832d0786a
SSDEEP

98304:zgu9llk/yHwNf3n48LYtQMKFfikjKdzOJDb4v+6Y:rllz0Yt506LwN0v+6Y

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2168	6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe
2168	6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2168	6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe

C:\Users\Admin\AppData\Local\Temp\6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe
"C:\Users\Admin\AppData\Local\Temp\6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
6f7c315e5697f7136dec3a3fe29e0dbe

SHA1
ca6cae9924609ee7838bf8b932c1789034265605

SHA256
4ca01218782887960be1087ad9f4099f458cbbfbc7ab238c19be5c8136308ca7

SHA512
08e3f63aac4d47095b56b3a8f9a73c396324d5318726127c9c1b7389effd5da494016615acd5056a731160c3a3aec0b4231a7435bdecea064afa7880c1aa17ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
49c59984d74939ee4a5a9bc790c5f4f3

SHA1
aaf74252594c3c40b5e0f1f8c3b9c9c8566468ab

SHA256
4866ad972f2415c7e9b3e048a73b53f34e70042d23b8b8b44bd0c2adec139d5d

SHA512
96921bc07f7cf50577f7af076d45852b7cd729ca6cb933bd0eb3eb6da93bd8f56a1ef9f76ebf688d8698ff91527a15180074aec579df8f9d4f15fa694f4f44c3

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
984506af20c1349acc3c4cfb97c8f3ae

SHA1
06f89d066ba89b16ed06c5d10ce702b1d61f278a

SHA256
2499a7b5b9b3d4d43eb1083efa3b107294c9fe1e56a10d77ea529644ba41accb

SHA512
0dadfd157620b85a0a02bd6268a1a972659290af2c9e693309bc737bc8cf54351f1ab3de04a4873d97966efbebe973d52842273800ae11ebcfab1df65662c928

Download Submit