662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752

Analysis

max time kernel
94s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe
Size

188KB
MD5

c10e79ef1a4b3a63580a43cf521ffe57
SHA1

b46247399f5c0af2b938d089b554ff84bb157e8a
SHA256

662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752
SHA512

1e7e4c19807184cb44f5ffdce38094a648c80c3520322cf967e0c6f527546256bd0b43feb12915cca01629ebe3d9824f3a96b92acdd8f27f51532fc37e84a645
SSDEEP

3072:IfuEm9uOrI0m3tHON/vaB5YeGOOW4yJGG6LAaW/dIgF/:t60QtuNanrGOPrJv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe

pid	Process
2448	662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe
2448	662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe

C:\Users\Admin\AppData\Local\Temp\662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe
"C:\Users\Admin\AppData\Local\Temp\662454b411bcab1756c0be7a2d7ffd0587d9a3347b3f9235fc292132ede44752.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x0000000001800000-0x0000000001B4A000-memory.dmp

Filesize
3.3MB

Download
memory/2448-1-0x0000000001800000-0x0000000001B4A000-memory.dmp

Filesize
3.3MB

Download