6cdbfdc2021a53982577b8707e68d5ee91243647ed86197f1e78ba042302d389

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe
Size

481KB
MD5

395a60d305eca089d0339e1f3cb58e9a
SHA1

9910634adf12d8ebb2ba615c25561a60d6af1723
SHA256

6cdbfdc2021a53982577b8707e68d5ee91243647ed86197f1e78ba042302d389
SHA512

7fdf773d95a034a9042d91c3625a57ff98bcabfb54e0278958990c673aa0eddcf24bfadddbbb1859a14cfa63ad409b3eb33331ca52f5d0cc5b0a48917a117161
SSDEEP

12288:nuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDS/+DY:a09AfNIEYsunZvZ19ZMs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe

pid	Process
4736	1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mic\logs.dat

Filesize
144B

MD5
b153c5b036f2374b613358d092a88e4e

SHA1
bac5f9a501ef8879cc8eb72fa2956a5b515c07c1

SHA256
80c8f3d908db05e0da7d840e69fc303e5b5932a99592f4fa1a600d9730b94cab

SHA512
80dcf4a2bc890f418cefb761573ddd66924ca51dec601c30e79da64b0ac59ba97ed2da5bc607a22798004a3719240c0d0e5300291866634d46d5777090ce0b2e

Download Submit