35cbb78b96dc4513c66d0492a018f7eaaaf20771471e0c1bc842c9b3f60cda33

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader/Loader.exe
Size

537KB
MD5

8aa8954d770c9c9536979dff8be7532b
SHA1

e1ec65360923f9597c8667cbfd1304f33919d7f0
SHA256

f373cda95b70f31c44bf44b34f856072206fe3ea8444475939ea6d680e3d3221
SHA512

6094033ed8229e00406da9278353b1aa70ed5b1f4d87edae6904c991a97c1302f3d641b2da6f637bcc576717899bf78c85a4f139074bc3f482d0e7aa4bd421b1
SSDEEP

12288:Suq4/EQWzaQ+07OEc5yFJC9Qc/Qs+adda/Rbo2A3n2BRgiJBCyJXWT:E48QNQ+Wc0GSc/JL

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1364	Loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe

C:\Users\Admin\AppData\Local\Temp\Loader\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader\Loader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
427KB

MD5
9663bf1acef5ef5958289ec787eb836e

SHA1
19ed828867f988e4c3ad1e6fbf659022dc42cd83

SHA256
6d377d9d59fd3ef90b89451d41685ed99d1041ac3db0b55d8a1807842d9375b3

SHA512
0ce50aabd9eeedae8afade2c496961b74de5970ef1dabd88ceda34e25d540128cd82ffbc0099c9cc78969ec1acfc09f7d4c5267f24ae204307829ca2736e274e

Download Submit
memory/1364-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

Filesize
4KB

Download
memory/1364-1-0x0000000001390000-0x0000000001420000-memory.dmp

Filesize
576KB

Download
memory/1364-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1364-3-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/1364-8-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download