38e4a29ab9f16e4fa94d66b4d4e8f43a24872da912a3bdbd341e0ef21616b576

Resubmissions

12-01-2025 13:59

250112-ran7waxpaj 10

12-01-2025 13:48

250112-q38asavke1 10

12-01-2025 13:44

250112-q114paxlan 10

12-01-2025 13:37

250112-qw2jnaxjcl 10

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AxoPac/x64/bin/keytool.exe
Size

15KB
MD5

9a4cf09834f086568df469e3f670bf07
SHA1

594c4e0394475a6299c79e3a063c7d5ae49635f3
SHA256

709e9e544434c52285a72f29ad6b99ce1e7668545f10ad385c87abf34d2052bb
SHA512

cd551e7944461f3288b880b9d161f19f97eb4599a3a46cc93c4172b5112960fb0c040b9996f13cf0761fb85a283e2f20944135ec59660c807a59b29cddc44586
SSDEEP

384:Gps45cnQ6DmSHhV8r0eeU4Szi6nYPLr70aG:Gpsnn4S/8rxeUvC7RG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keytool.exe

C:\Users\Admin\AppData\Local\Temp\AxoPac\x64\bin\keytool.exe
"C:\Users\Admin\AppData\Local\Temp\AxoPac\x64\bin\keytool.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-4-0x00000000026D0000-0x00000000026F8000-memory.dmp

Filesize
160KB

Download
memory/3000-9-0x0000000002718000-0x0000000002720000-memory.dmp

Filesize
32KB

Download
memory/3000-12-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/3000-28-0x0000000002708000-0x0000000002710000-memory.dmp

Filesize
32KB

Download
memory/3000-30-0x0000000002710000-0x0000000002718000-memory.dmp

Filesize
32KB

Download
memory/3000-29-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/3000-27-0x0000000002768000-0x0000000002770000-memory.dmp

Filesize
32KB

Download
memory/3000-33-0x0000000002778000-0x0000000002780000-memory.dmp

Filesize
32KB

Download
memory/3000-35-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/3000-37-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/3000-38-0x00000000026D0000-0x00000000026F8000-memory.dmp

Filesize
160KB

Download
memory/3000-39-0x0000000002718000-0x0000000002720000-memory.dmp

Filesize
32KB

Download
memory/3000-40-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/3000-41-0x0000000002708000-0x0000000002710000-memory.dmp

Filesize
32KB

Download
memory/3000-42-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/3000-43-0x0000000002778000-0x0000000002780000-memory.dmp

Filesize
32KB

Download
memory/3000-44-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download