a1c489cce0663f3ec6b057a16f951d455b04458553803b07dd356ea4e3ccba2f

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugin/Duck.exe
Size

63KB
MD5

d7d46952778a85491b34f62991a060d4
SHA1

ff30ef03867eb74f2454375cbe3508ee26b07163
SHA256

5d1217e2c9e820c3e7b2fc28fab4e40d85e0e9f4362e66a451e42d597b8c2650
SHA512

7c9b4c254a1977d1a16ac3aa8ce81d897eeda4465e51c9f0cbe2c03326cc6c3bb7acb89d8d1f4ce1dec03118574b57f30a3400b2dc47b70aa87bfd2f4f99f8bc
SSDEEP

1536:miaFJkobMa8dBXu2IbV3DKyBzYDEBUhYW:miEbMRdBXnUV3DKyBzYDEal

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Duck.exe

C:\Users\Admin\AppData\Local\Temp\Plugin\Duck.exe
"C:\Users\Admin\AppData\Local\Temp\Plugin\Duck.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5052-0-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

Filesize
4KB

Download
memory/5052-1-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download