9bdcf8eff9c0954e1164c61d6f2f37ffa99596bebec61c57319c691912b5b1a9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bdcf8eff9c0954e1164c61d6f2f37ffa99596bebec61c57319c691912b5b1a9.exe
Size

7.9MB
MD5

ab84280f6d135ec84688e770e29fff86
SHA1

9f1b645c0729b68b502d3e454fb754f8f2b6314f
SHA256

9bdcf8eff9c0954e1164c61d6f2f37ffa99596bebec61c57319c691912b5b1a9
SHA512

5761940f20e255c9d7d7a71a5861d551f8ba01d644cc4dfc37c5bb5a1ee616d17f098ca6c9a926f9c907bb20429528072311352a18682c1e4592d0be8a82b2a9
SSDEEP

98304:Xg49ZaYwsmJdj9PfPHRCjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafD:XgP34NTx9Pe20/zkOiu1f+79YRck

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bdcf8eff9c0954e1164c61d6f2f37ffa99596bebec61c57319c691912b5b1a9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4968	9bdcf8eff9c0954e1164c61d6f2f37ffa99596bebec61c57319c691912b5b1a9.exe

C:\Users\Admin\AppData\Local\Temp\9bdcf8eff9c0954e1164c61d6f2f37ffa99596bebec61c57319c691912b5b1a9.exe
"C:\Users\Admin\AppData\Local\Temp\9bdcf8eff9c0954e1164c61d6f2f37ffa99596bebec61c57319c691912b5b1a9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
0c749758e2337e1fe442e3fc58792908

SHA1
a643bdb6737c97a10a81266e52b35af6c1779eb8

SHA256
2e5d15f982b18bb2fb96ac0c44e7c44baefc4c3bb99082ff702154f8f9de8f14

SHA512
f7ce4b01b74d0db47f0bb550ac9f09552b4b2de97ad8d5809f623770eefbc4a00d6a0e909e84f0fdf023f83ab69071dc2076273a92a31f8bc9008f727c6fd1b5

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
b73ba56fa4295bcbfb1cf93efb365f34

SHA1
e4303a5200ea33cd3ad36d02b2e49bc9541f4eb8

SHA256
6026e421f02f13a2afda825fbfba167a2cbe528eeb2c42b77bf6540f4c189367

SHA512
1ac2374dcd356e57328013ad6a59675133c382bf07bbf62a51c1d15569391a339397aacd50ebbb492692b231899321fbf02ae90bbbd0bf0a64fcd1d88fe992e7

Download Submit