41d0046ef2bbae34b1c29ab45723e56ae6a9e3d5efedac2b0f348c556f9858f2

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d0046ef2bbae34b1c29ab45723e56ae6a9e3d5efedac2b0f348c556f9858f2N.exe
Size

764KB
MD5

77c997388882ff151fb80417621d9460
SHA1

7176888fd4d643ff885afca74ad9f064be04b2e1
SHA256

41d0046ef2bbae34b1c29ab45723e56ae6a9e3d5efedac2b0f348c556f9858f2
SHA512

3e9dc7e733a116ecf808e283ddb9ba5b673cc964ca1114293e45c75d4c01c7431fbf70a17c9842e67ed07dbcb59775958c8f27cc4222f66b73eaab311e5fcaae
SSDEEP

12288:xe8VO8tAFpzp6raoUnfM0wbN7bcurLraSatWFjGhiVg72IE8WD+hNJJ9nmsKnWqG:xe8GG8uuSSwjGhGgTEtwJ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2072	41d0046ef2bbae34b1c29ab45723e56ae6a9e3d5efedac2b0f348c556f9858f2N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41d0046ef2bbae34b1c29ab45723e56ae6a9e3d5efedac2b0f348c556f9858f2N.exe

C:\Users\Admin\AppData\Local\Temp\41d0046ef2bbae34b1c29ab45723e56ae6a9e3d5efedac2b0f348c556f9858f2N.exe
"C:\Users\Admin\AppData\Local\Temp\41d0046ef2bbae34b1c29ab45723e56ae6a9e3d5efedac2b0f348c556f9858f2N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
453KB

MD5
33dcaee67fc3b4ae32fbb2dccc4ed0d6

SHA1
6758980679c6529360273d3a5dbca2d665e68175

SHA256
48facd3f6c7afec3e03dcdb000e931b25b48667b3c0562b6a64aa6377d464c30

SHA512
fd5cb79d28fd5ed6c5a36565888bd3b2dc80ade559c83e08c704ac43d5e84841cc9b9bfc26aa7506c61ac82f5e350f8413b7e9f3990b2e0f45a9cce75a3b44f0

Download Submit
memory/2072-0-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000000CB0000-0x0000000000D78000-memory.dmp

Filesize
800KB

Download
memory/2072-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2072-7-0x0000000075C00000-0x0000000075CC1000-memory.dmp

Filesize
772KB

Download
memory/2072-8-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download