6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74

Analysis

max time kernel
92s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe
Size

5.0MB
MD5

6603942b6649f4e74372a51a0758f231
SHA1

1d2aeaf82c3a661e169f97b9ad27fa5f28493fb9
SHA256

6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74
SHA512

22b17bf8de7079faf842679d0bd60b8fdcf01504dc98735c73687bbbae1090fc1b420dde30e8d4817c55542b2b3252c761d4297310001c0601aade8832d0786a
SSDEEP

98304:zgu9llk/yHwNf3n48LYtQMKFfikjKdzOJDb4v+6Y:rllz0Yt506LwN0v+6Y

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
964	6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe

C:\Users\Admin\AppData\Local\Temp\6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe
"C:\Users\Admin\AppData\Local\Temp\6da8a3f88f65a0e23876c22f5e9b755e396b2910978dc0768d6a06c016de1b74.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
3fd574d799cf58307121864bfa9410f0

SHA1
512cfebcdce308b328d537459da2fc845a79c44a

SHA256
eb052e45a6c4566fa9e34cd518760ea3ae3b028b4f14d389e6dfe1c8a4e1a85a

SHA512
9af6d1d18ccd346388752f779ab3a303e014487cddb9c2fc9dcca6fcefbef8c0c9aa9a12b1d07c5e9b4107d3ac8aee29473fa57bce86f6e662be9c9eff1a963d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
094da105e4445bace1f53baaf1ea298e

SHA1
f0b1697526ff12862dfe967df3b07b0270c0a1e7

SHA256
8762d8663ade9b8cd3b1c0644c00aca52720004aac53ba523057236bd72ec3ac

SHA512
c7c2388b29f7b0b401a4092cbf77d5e225605d82a0253d0fb29b74195dd41c503b8327393e7fe0c7f6510f34c8bca0b5ce487e687c4aff1ecd6e4d0eefc38e05

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
f735135fef7f54040c248cc7d000213f

SHA1
33942cf9fa40386e7983454b3b633c7821f4187d

SHA256
a95a5ae10eb462271c1a2295c2ea0a71bde8830df78fd713ae8c837c4f44886b

SHA512
b95e963ef8b019800eb91efa5f6477abfccacfa515bb5e06af67ae80b45c9f5a3eb4621ff6c9e44ae37b8fbeb8caa17a8cf954ff8f52af65be71b6af7abc943e

Download Submit