5de180ff35a8a0835dc704f4b8551fb1bb196837358c2020f84849c4f517fad8

Analysis

max time kernel
99s
max time network
143s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07/12/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord Account Generator v2/RDXService/build.exe
Size

255KB
MD5

8629c65903ca26e7ffada84c69ae0972
SHA1

015673ba0498ae35bd4da1c3ba45bab5fbfa18ce
SHA256

adc6887d772f9f47ab67406cc9ea7dd0177b94d84f98124fc712b9e66208dd0d
SHA512

6a3b8717daeaed8dde18cedcb1c6fc31932f01234a63b80f37c6960f7212255cd32d1c3135d84da773e7b94ad1f326cc965463b9fc68f35b8b5449ff70d79af7
SSDEEP

6144:Ja1FAmxe7NnOrQS8ksy3tiun59xSAO5Lxgl:JarAee7NnOrQS5sun59Aftgl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1124	build.exe

C:\Users\Admin\AppData\Local\Temp\Discord Account Generator v2\RDXService\build.exe
"C:\Users\Admin\AppData\Local\Temp\Discord Account Generator v2\RDXService\build.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...