8f9d2e86ba1ca041ad4090aa8d3a067ac6753914c61127d91bdc7ac5640fe821

Analysis

max time kernel
900s
max time network
840s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ReactBot.exe Download and Patch Notes.pdf
Size

71KB
MD5

0b29ba0bb192b252abc4f7ae4a908134
SHA1

b53093d1bbc7500c42d8474f82a47413bd44507d
SHA256

8f9d2e86ba1ca041ad4090aa8d3a067ac6753914c61127d91bdc7ac5640fe821
SHA512

3667d8882252f0cc0c4c96beeeced85c77fb3f7f4fe177b13567f93f4fbf820d90d43f46d4a3252a407a646a7a2c98064a60b181a6ec83bf5f63d1bc73d248a3
SSDEEP

1536:WoK7kludH1owymkiPnsWHPGQr08g2qTT1BAnItIPjVDyI/h:27wu51o6PnsUFrCTMIsB+Wh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ReactBot.exe Download and Patch Notes.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dc769e02addd7045c09dce6a0965aea8

SHA1
18ddb1a545b3aed2b8cf0128602a5e4795d3ef7c

SHA256
31184c63e0a9befbbb022e77d4120b6982e839ef1d3e73cb98c62c4448f7a31f

SHA512
d928d1aff8a0caa55d7558f88919a1352e02b5323f8e2f6a2fce140d8c2af61305dc592dc82d7989c29df0484176a73c846030df1f5198e560105fce02d51221

Download Submit