11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9.exe
Size

501KB
MD5

e619fff5751a713cf445da24a7a12c94
SHA1

9fc67a572c69158541aaaab0264607ada70a408c
SHA256

11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9
SHA512

07420c9a0336ae350567abf68d7f5ef52b34c4c010dbabae6693bf27fd5a50a8b2b16696a3bed7bdc846d542eb04ce6102d5387484f352f9d09c8789ccfcd9ae
SSDEEP

12288:dFLn2Q1hI43dnpz9xDhrGooNUlN0HBcSBkAoJtMpbqrI118Lw3PTf:I43dpzvDhfoigC

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9.exe

pid	Process
2648	11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9.exe

C:\Users\Admin\AppData\Local\Temp\11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9.exe
"C:\Users\Admin\AppData\Local\Temp\11fbd295494309d56d775a11f805544737ce71d058a716194c0fd5b800cdc6d9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
256KB

MD5
8d662564d514751028c65d96c696271f

SHA1
8e27943b7b901a808d39a7ee6977e1d3769a15fb

SHA256
86af5d6ee9d824ec2dfa73f44b9ae285d33e9748a8b6dbd4333d1ae06cf6f72b

SHA512
0a5460bbe7f43db560a08e508381613098a28de208a9d85c9c41fffa62b1e0299389a575dfa2b78767d3dd0fc73f0c88677ca32d7fe4e87698def1386cf35bef

Download Submit
memory/2648-0-0x00000000741AE000-0x00000000741AF000-memory.dmp

Filesize
4KB

Download
memory/2648-1-0x0000000001250000-0x00000000012D6000-memory.dmp

Filesize
536KB

Download
memory/2648-2-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2648-3-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-8-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-9-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download