ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe
Size

718KB
MD5

b4c67501b2783a3c86c8a9b98a5d6798
SHA1

9398be29fc39ce17e01d627050958e2600b324dc
SHA256

ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa
SHA512

84e46ae5711d0585d7e6c5114c3d28b2192fd69228a64f13080ef1b3c99bf40debcb5d82accaeaae0a77d5bae8691edda19eefd8484851ab24108f8735160da0
SSDEEP

12288:1yAtZvj0KxDQsJJr+rwFoKseqaT3ChHLpSjOL1xWONh6WekeI1K5LUpzpVIK8U6+:1yAtmEBQwFHfZTy

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1316	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe

C:\Users\Admin\AppData\Local\Temp\ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe
"C:\Users\Admin\AppData\Local\Temp\ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
427KB

MD5
9076b45bc5d8605213d289c3d9982f6b

SHA1
c7d2b90764db9b7767f4d968384e371c2e42af08

SHA256
93d7f73c3d8de7d2f51d842cc36196ed60ff4c9df32b9a813dbe6b08e8268d63

SHA512
85a9e09dfbe44287fa58424f5e68477bace4696a361271c6bb979b545ab45fb20649bb277fb334ea68bdb9b4f79f7602ad2aab6a5cdfd1a5468ebe4d0ed29149

Download Submit
memory/1316-0-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/1316-1-0x00000000011C0000-0x000000000127C000-memory.dmp

Filesize
752KB

Download
memory/1316-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1316-7-0x0000000076600000-0x00000000766C1000-memory.dmp

Filesize
772KB

Download
memory/1316-8-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download