Analysis
-
max time kernel
26s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 12:58
General
-
Target
LINE_V9.3.0.3436.exe
-
Size
1004KB
-
MD5
587e3bc21efaf428c87331decc9bfeb3
-
SHA1
a5b8ebeab4e3968673a61a95350b7f0bf60d7459
-
SHA256
b931c5686cc09b2183bba197dc151b8e95ca6151e39fb98954352340c0b31120
-
SHA512
ffae2dab5caf16dc7dfd0a97a8ff6349a466bc57ee043d1ac4d53e011498e39b9a855295d10207ba578c6857abebd445d378e83aa2ff6ec247713d81b370d0ca
-
SSDEEP
12288:gwrY4IECJHENxLp5S/rZn0YzNTNuF3/C/JDeS8mJhcVBNtg62KFPr:g8NqqUNTNuFvOh8mJw3662Aj
Malware Config
Signatures
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LINE_V9.3.0.3436.exe"C:\Users\Admin\AppData\Local\Temp\LINE_V9.3.0.3436.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LineInst_240631250.exeC:\Users\Admin\AppData\Local\Temp\\LineInst_240631250.exe /M2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe"C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe" -afterinstall3⤵
-
-
-
C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exeC:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe2⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe"C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe" run -t 2406504063⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\LineUpdater.exeC:\Users\Admin\AppData\Local/LINE//bin/LineUpdater.exe --deploy 9.4.2.3477 en-US real 04⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe"C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe" --updated 9.4.2.34775⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe"C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe" run --updated 9.4.2.3477 -t 2406672036⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD5244cc38cfb1e2cd201dff7bb71198c8f
SHA1be7fab2072605485653f4718e5b84dc02396091f
SHA256d9841bdbdfdbbac33d621c879fb16caa6ca7332a44da76fc35a79dea386b22e9
SHA512ff64666918139d10b8c183f11082abbdfab42279e19135426aa8c14964581814df21236d03b09e4701a4e5aac10376880a9aaa6d950e8eb9ff35a95bea089da7
-
Filesize
14.9MB
MD5ca236ed88dcead0d7537d319b4dde938
SHA128d956839b4fd3a20c8b2e700c5b3a568bd9b54d
SHA25617fb3e614ed99d92aa04500149d6a2841c5872ab34e8c6bcc91a65c7bab2d43e
SHA512ff0325f6221d33e687ef1b4291c599fd3c71e60289d032f096785c48835bf3186fcf4032dea3c7ec9b310610813c1aa4b8bb3c1ab2a52c9d2bc6c478494e202c
-
Filesize
3.1MB
MD502f554541e0036d6fd7bf2d333b7f0bf
SHA16a3f2d00bae392b184c7932f4e394b445ea8223c
SHA256f822d5ee04cb5afb6c9ddf0a760c50196fb5e3b7221a665ac1329988f6565856
SHA51253082de34cbf94ce9bc168dcee968f39abb00b88b4f99e327ab03113c508ffb1514b757f86e5bc4e2d3e0b577f9915e5b4675b7b3f154c1ec83565bd4eb69dcc
-
Filesize
1.7MB
MD5a4bad7925d81ce54588a4b35063d0104
SHA1d3198c1ed0e01610c2e45c13dddf6b3e49c0b4de
SHA256ae2cc3ce522aa600a177e19a87e21871813977c70d0ca70cbb6cf6cf65f96aba
SHA512e738a66b81b1cdb552d07ff974666178f94fa80d47dbb5c00994149152e70f53ab140efecec63c3206a68e948756cc6d2ba6c78ca970c56fc93c6cf64243ea85
-
Filesize
171KB
MD588c2630c8b9788fb41c18f2535c4a2a5
SHA1b9dec751455ef505690f137571ce2db3ae7ede4b
SHA256b0d2fc44b42a0d60fba7ad89d535b5c677b9965d3f09d74fc486359267d0cf44
SHA5123f593583c18fd2b230181118366d009d1c17f4da8a894f65eb979d63337cbb9e3d4331b6d27396d5d872d6be96036703c4a9d1316ef164ea1f4cc5cef39c56f6
-
Filesize
3.3MB
MD5becf6bfcc9667284a88e46869d1bc46b
SHA1d750e28982db7a1c90dc95d9dc0682a1f07818a5
SHA25682249727558823b8471e98b3a8c18764d15318b812f1b9524d9040a4ae4f8657
SHA512aeb54f1f9cdc26e8ffba241e4e185942fa468580102e8af4d4d04699e95e34cda5ee6752b55da30e9bec8031b3b399c1582f11076d3d57deb009fcccf59a4203
-
Filesize
566KB
MD5a62a22c33ed01a2cf362d3890ffa70e1
SHA1ea3f55d92cdcb788876d689d394ec3225b1d222c
SHA256003da4807acdc912e67edba49be574daa5238bb7acff871d8666d16f8072ff89
SHA5127da909a6c5dc26631fec8a382d5cb677d3aabf5b5c4e98b545c120685f879adcef8cc98e7bf74d37f7fc24b0f18999780d70aa28061f50adf6b28f19ce06930a
-
Filesize
5.9MB
MD56e953efa169f7746b90558aff0bf5c97
SHA11a1b5386dfe8eb412e3f414f766222dba93da32d
SHA2560d3bf792b9b142ef10f9698f03921ba5d4e029a960975861453a38562e6341a4
SHA512df54e6c030ec2197082a2134bb5632fad77a0d48cee9061c95746dcfbe4a24effa3cbcf0c0503809d074e4fa22aec3c931e563d765a166bc1008919e6ba69dc2
-
Filesize
850KB
MD5ae3eadcaea9606ff016f229425205922
SHA192e473a454893b8503790cc263e25bef1f9e6b21
SHA2567284b02652c9a7becb9b463c1bd5b8213a2b1efa788a923a9c7a0d3261e66118
SHA512e9129535fb89ba7a3d17d30f1274e00e016a06f1fce7b96fee6543a68bfbd0bceec03e1eebc2fd258d2ac2941c1e73494dd26e5024ffebf1cb82da65ac2b1165
-
Filesize
8.1MB
MD560a53995b0f470905a71a2400feb9fd9
SHA17c45ab27a13090f2704b80af94a36a9c30525588
SHA256029055f9149aed18e5216a1793dbceee38c33f76399d61f9ae79a6f263794610
SHA5122cfec5ec6be25d42594eff96dfa5711fec955d83c23ddc76637898b1eeba04ae7c3bd01c089a3fb2c48cf5745f263dda5c8f6221b0516394b79d850e7ea538ba
-
Filesize
852KB
MD568b21cbecaff415773eb99b4f0cb07b9
SHA11100fb139570dc278b7cd8a87cc30594d014b372
SHA2568be4916abb8354b8f738873138fa61d13f805178d85f0bd35fe520e59575aef4
SHA5127e7eafae138c81e29123dfc49bbb9366a2a0b1f600fb71d09fcd78818316bd4c710a0436dce19e48f2e54c2b8bdf55123052930d8f4d6c270ee3ff177ffaaa68
-
Filesize
1.4MB
MD5eb0bc1bd676ba558f92494f6e879b959
SHA1f1d6bc4d0acd5a0f12910b42ac90cc1f369190c1
SHA256a126ade93717aa5efa6b2d4a7623ab3b9de7ce79c86dcf12cf587e8182808ab9
SHA51288bf24428424da06df25aabf54121aeff49481a781a445e08e98071f0a8e502b4ce41c78b1007bea5afa5cb6dc13bddaee453d79c2598c2ed4f569766c4e82ca
-
Filesize
1.9MB
MD58f4e76ec9936bf1a42255acdb9b99127
SHA1000a7556e905c79ec24e91f3a7b66834a4910bef
SHA25697d91fe958e1a2491f9798c63bd78679fa12b6e8144c36297a3db4b73424063e
SHA512e2dfe462315ffd36f100a64bc0cab4d855e476d9d2f278367be7f67d1c08f4c3c1c2af700726bb2695e7b66bab19f3aa943134e6ca342f830ed9649eaf9b76b8
-
Filesize
4.8MB
MD566d259c58aec3a291adc5582e8907dca
SHA1649863e78c448920ba1fdaed6b7abfd9e4410d41
SHA25609290ea947363728d35ffdf830045a3e21bc19af2967415e6ed1622fbec949df
SHA5123cce3115c900d1c4f934243d936b89316466914087c5d312ed906a83e7e27ef2ec71f3eeec5612863f4ec7d8ad68862d2911350a717be3fe5e57e87cbdce7173
-
Filesize
712KB
MD5a247e51008d1967fd18e0bb51c70780a
SHA1df9e84caf5141f070f3ee1c0cf952c03a80edb23
SHA256614d9ca8838c7955f149892d7b4fd5f9b8067ca3fa5fe0c912eeb50245fc19b9
SHA5126dd36d912e7668d27929c99ecd36b50d761e2128ea1ae30ff074a3656623a58a93cb6de9ee399ecaf6ddeb28ea10b57a1c85484fb3093e2d357afd9ebe480642
-
Filesize
5.3MB
MD53a9c568b4db6d9085079e7eb8b6372ea
SHA19fe0bcba8fe9170ee8101c7413983a5aaf1f385b
SHA256682746073e9c1cca03b9eb12475cf0050b4bd0812d4dbe62e5ab1b40d9fd0b42
SHA51224e9a6dc4a78cdbf2604d03a6de19ca75e7404ab5fce855336d1a7c68e129f3fa067f68554a55ae4bf04a998e02bdbe69cbd78af4bcca292480ce1a3d51ae4c7
-
Filesize
383KB
MD5c2ffb9ea51a8a37a33bd8bdd59272db1
SHA1a6ec79b0c765638c542dabf565b54eb49d5542d9
SHA2563e8ce05635bb4d0154c5d882e3fddd993ad7bca8bd857eaf39cd35c135303cd3
SHA512e67f825b2440c4ae97ecbe545a0afa95f6fa994ec5d91962cd78ca8b6834c926bdba415d56b633ce949023d15b902383bc3ba4d54f78fe706e02d99bf458f27f
-
Filesize
140KB
MD5e6803a778a125fc302b6b5ed412499b0
SHA1bb360c2a16ed54369095478af1c60c01c566b76e
SHA256680767cc9a9b68fe1154063b952fcd199c2bf5a1faa3f90efd45cef8cee810ea
SHA512056d30a2bcd0fd3fbfeddff245ad46b4d28894c3cafa8e119c11e16b0f8782238e53178af010fec2ff7f5feebc4c58f197383784b51e53b3e6c755d140cf09c9
-
Filesize
6.1MB
MD5ef277e18ff92658ea7a8d9b72ccfdfd2
SHA11b66db0116c923a2b9a336bb47748f781e31b431
SHA256a5cfcc056dac0ad992102db8ac25e97384913e9e7047d370c8e858ee64a46999
SHA512d0b5766b56682625ba36300e84539d02f9f342e55a4956f223df011a6a657558efa3d141f0e7191dab9a16945bc5a745217d7a1f7317158ed646f3c83ccf6104
-
Filesize
135KB
MD5bceebc73cb9e3f239b99575c0d38951c
SHA1d71033e74b44ae5584b6be1d4cc99e4094f5aadf
SHA256f86b7be36295297de21bffccfde3cef776e175478592b4b16c3063b420723312
SHA5122cac4b095a46ab625ba7e4c9297133df1ccf3e87eb45938fc65c3ffe6cac31204229f3f4cedc6e58244bf74c76fbe9f2fda7710c784c79814e5ee2ccfb1994e7
-
Filesize
18KB
MD549c3ffd47257dbcb67a6be9ee112ba7f
SHA104669214375b25e2dc8a3635484e6eeb206bc4eb
SHA256322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165
SHA512bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98
-
Filesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
Filesize
20KB
MD5588bd2a8e0152e0918742c1a69038f1d
SHA19874398548891f6a08fc06437996f84eb7495783
SHA256a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094
SHA51232ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f
-
Filesize
1006KB
MD5623c9754952a35b018f2448af8184075
SHA1c37c32c391c509d0bfc8522ac7018a3c4b2a1940
SHA256f089f6b1aa2a324603728c0453568201cb0ab6b8d3e8d6dcc2b000ad5cdfaba4
SHA5127f848c186962abe6d9db18406ecf26f824216ebf44a4972f1681ac89a4b793dcc43287d3d1bbe8d13079e80d4718ca59fec500c2dd8e5f17b61035fc0b2b3c43
-
Filesize
2.2MB
MD52015b36a4ec425de3ffde0153f327b45
SHA1977fcdd554a9b1455336a426738a5bbf7c5924be
SHA2563e5ae8ff2bd0cd20656b83bd2e4375b038299cc6a85ef04c255b971d4317bc9c
SHA51224a560133a0d63db91c5c8adbe2b22fc6bd46ed25b266aa9859ed5548cbf41ef48acd2307b66e479ef7a9fff2e74caed8d238bddc2b69dadc8984ee85712dd46
-
Filesize
2.4MB
MD5b85488da78e6fee382de1726860b5f9a
SHA17e96fc54ba5b96bdded6bdf28fe1267133032def
SHA25677018a7735e434822a2f52656be85546cab93bfd9388b750ebff6aa0a490a649
SHA51223ec1cc429226a3172c25c1a46a52e02d5d8e1a314fa054dc6d2bb6948d33cfc26ad1f70a3ac7cbd9217226e3d304f84c9f5e066c6269e16b13a2a120592c0ee
-
Filesize
628KB
MD5970996fc9b4cdbb10af6044507d5b7ae
SHA10e1b2957753c458ae9596901a6cf3c70839b39ec
SHA2569fc18a126e7167f422a574a71243e04b9d73be666b24ea7a054822c6dbdf30e4
SHA512b3a5e6a4ff24e918f2c278643e4b1270c69732199707b6db729b5b6c7d0af30c15c6eebf6a3fb36fe4208d12fa96c7713cbe7a00770233a51deb1b860af18ded
-
Filesize
34KB
MD5ae146db58039e40b9b4bf1c6fb973d07
SHA1ac0700813a2974f6d5b91c37ccabfff0302d7be0
SHA256a61901a4d719a3e1cc4fa8f629218571330331e8dde2ef1f05c34845b180928e
SHA5120ebef21b9935d498a749ac5b90719c23dec1f2209a8fdd17919cfca43aa098c64cad687643412dd61d1b4fa573e09e9f7b27a1e0f9a82bb892816045998a186f
-
Filesize
192KB
MD59a4033b3ba1bec07d20bc30abf097222
SHA1979c97d5b0f4d83de7671d018b96aa850e9d94f2
SHA2563d15cfe238ac1863bbe65501f05d561162f28032b80f2c8d9a1fc7b22f8445a2
SHA5121dec8c3760236483935c17c2a98ea73aa579e565fb20745fc00891ae2d79e566034a6405482ef4d618fbd7de7cbf30c7bbc1a9b72ed0c809f01203550098a21d
-
Filesize
5.4MB
MD5ce8f5d2f0f62c626edad01f0482448c7
SHA1198b461b08220af35548b9ff143aefc78e5ee7a3
SHA256e13ea4e788014abdf8c1cc8a02f2eb3f228c14a9ee810791842236ca1afdc4b7
SHA5125710fb40c5e30eea64dfafff62cfe1b4a28c1be2844966a0ea36c192d83294582f57c92bee42c832d15d46e53eac0d66e02736bc6eb1bb1d3522840db3fea8a0
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
48KB
MD57e668ab8a78bd0118b94978d154c85bc
SHA1dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA256e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
SHA51272bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
-
Filesize
1.6MB
MD5f6ede69472be4a0ced04332bd16f4365
SHA1431016c95153512e0aa9b9b76b73bb2887c4f21e
SHA25656a26e791f76e13f1a1ae0e3d36e34921e219d7ca7114d51c72be1c9f12dbf87
SHA5127d2458aa003bff3301f66dd77d623d395ce578d0655f3f4d1ac458059381a65753976d6c9c4c57f5abc37e1527f2c970554743180bb4c7da8ff1d524c6f96c29
-
Filesize
11KB
MD5d77839cc52a47e2db7d7fb944643fb0a
SHA1ed3cd493e5a465a143862df3f280e936f3bd2fac
SHA25693b73294a24201a4299fd0da7e0ab0dbffa130da300cc3a2c80d2aa7f2da7c77
SHA51276f2739990bfae391f8c4c7346487150fa70eca82a15adff14e84d83ca03af5b202b8abab139f56b59dffd942a26aacdb359548367be7f80ff6bbf28b973e77e
-
Filesize
4KB
MD56461ba2b54c2239503eff55de913c437
SHA17796499cc23eee4c522be381987913e6c5e8826e
SHA2564658e40d14895f792cb5ea8bbee7dc95a6bff6478f8e41c3732a66b92fccc0d5
SHA51212ae466bc824d57d8e44b5a2dca395b98f002fe3cfe4ed544939d7ce5480b174934adf4e9e06ea9d6907e64e180f1b1b6f9d25d607713ca23bb090f1cf3379cf
-
Filesize
89KB
MD5b9edf77857f539db509c59673523150a
SHA123276a59846d61d0a1826ba3b3f3c4b47b257f20
SHA25662f8e07d3ba5e9e57aaf529786a92931098f6ee33c6ab5057be5ad4ee0545b31
SHA5128bedf1ffd4d5f1853e1794e32b7ff482c3c207a8d6600a54d9f0c583feac8711ac70c985f4579a947ee3c686e179dcdf42752bb45da2a5b9254f372265a92f79
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
5.3MB
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
2.0MB
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
76.8MB
-
Filesize
6.1MB
-
Filesize
4.3MB
-
Filesize
76.8MB
-
Filesize
5.3MB
-
Filesize
76.8MB
-
Filesize
8.7MB
-
Filesize
8.7MB
-
Filesize
8.7MB
-
Filesize
8.7MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
6.1MB