611fe530fb6e67415f6a5ed53e1961180fcb89bb1caab4fed64feab511a89813

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 14:44

Target

SExecBlox_Bootstrapper.exe
Size

37KB
MD5

fc04578c59cd41466d533cbcd7157282
SHA1

201be3e8474ca4bfe58fd5761ea62c42645d7fd0
SHA256

611fe530fb6e67415f6a5ed53e1961180fcb89bb1caab4fed64feab511a89813
SHA512

6c661d6c05e7729a1f4abd869b2e5b24cf2b0393f65d6e36c3f7c34502dd02f91b414cc08809a12209d7decd8a2250939f4f1ba7430e472e515a4f7816340f2b
SSDEEP

768:fb3MDF3lFdS7IVW5maePrM+rMRa8Nuv/t:fb6F3lPSUVW5oQ+gRJNE

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

Processes:

SExecBlox_Bootstrapper.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SExecBlox_Bootstrapper.exe

C:\Users\Admin\AppData\Local\Temp\SExecBlox_Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SExecBlox_Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2324

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2324-0-0x0000000074351000-0x0000000074352000-memory.dmp

Filesize
4KB

Download