9994b9e197b422529221de7238dc0e44ae21e66d78c48355f31837c3696ec90e

Analysis

max time kernel
61s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe
Size

297KB
MD5

cf19765d8a9a2c2fd11a7a8c4ba3deda
SHA1

63b5142b07b7773d4201932e7834ac11eafa1ab3
SHA256

60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c
SHA512

b97fc305bd0d22e26abf99e302b166cd5d2bb959eddecad0f45dc978761178f5f6d47788c4ad5098313e587198abc66a3477ed42203345c20dc07db4783bb762
SSDEEP

6144:thP45uoAaSWyz8jVnA183ipgz7YGGmEOM8xm53Jhuy3/uL:t25uDiyzmR7kYVxm5i+2L

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2772	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe

C:\Users\Admin\AppData\Local\Temp\60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe
"C:\Users\Admin\AppData\Local\Temp\60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
435KB

MD5
330f34f58ccf18d73fd3762d200a21f9

SHA1
3c5b99bcbd2d8e1a02040a8b25aebdbd274f422c

SHA256
9110eaaf2945deb7a1af94855f90ff10a342ae5ef8d70758d5924fa2371d92fd

SHA512
6df28801cdf4a6f59481e3ac93d50637308be7206958b2cb395cc74fa851bcd2e25fe5f9e926db2b537f0eef9cc32eb2a96c3e821a0c51ee57e1b8ee4aaa90cb

Download Submit
memory/2772-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

Filesize
4KB

Download
memory/2772-1-0x0000000001030000-0x0000000001080000-memory.dmp

Filesize
320KB

Download
memory/2772-2-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2772-7-0x0000000074CC0000-0x0000000074D81000-memory.dmp

Filesize
772KB

Download
memory/2772-8-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download