a8ad0cb7c6c4d332bc50ca8af649af8877555a79e0d4d1df3cad1ea68acd26fb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/02/2025, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Specifications_BOQ_SPEC_UAE0225QNA01700-2025_AlRakhaGroup.exe
Size

1.9MB
MD5

1a04fa37208f321601c9cd4fa50a034b
SHA1

d6c57bfb13ca893e7f3aba18944b1b47f7e5e8b0
SHA256

a8ad0cb7c6c4d332bc50ca8af649af8877555a79e0d4d1df3cad1ea68acd26fb
SHA512

28e175f51548e2a8726130f79983a96980486e6404d8d4fb1e23e63de7cb98451b42d75ac66bef6602b5a845e9b23d6a927b0c232876b943153e615cccb037fe
SSDEEP

24576:lWF97YPear/DtoCsSkWnFRRGISMS2+t+R3qOzi58Uv7pDyE5vjgJCXs0ULNcHj9J:lWFuLZoC0CGIAOzi6UDM2X8uD9Iu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Specifications_BOQ_SPEC_UAE0225QNA01700-2025_AlRakhaGroup.exe

C:\Users\Admin\AppData\Local\Temp\Specifications_BOQ_SPEC_UAE0225QNA01700-2025_AlRakhaGroup.exe
"C:\Users\Admin\AppData\Local\Temp\Specifications_BOQ_SPEC_UAE0225QNA01700-2025_AlRakhaGroup.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/976-2-0x0000000000400000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/976-1-0x00000000036F0000-0x00000000046F0000-memory.dmp

Filesize
16.0MB

Download