Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 03:32
Behavioral task
behavioral1
Sample
LEX2.dll
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
LEX2.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
LEX2.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
LEX2.exe
Resource
win10v2004-20250314-en
General
-
Target
LEX2.exe
-
Size
196KB
-
MD5
25f8e47eeb9294021b5b73ca301020c0
-
SHA1
2072e2827682c30b4781b7b35a07fbc35f69f3ad
-
SHA256
99afe0c5ca3d147c492001ac34a1bea8fb44134abcfe4c7228c2e1cf11a59afa
-
SHA512
ac98896b6f0de6d4c3f25d311aae3467a6da9bffe7c5834a83292534bd8df87f28e7166ad580986721322aa59313c0bfeea8cad863d60a7c727181bf0fca554b
-
SSDEEP
6144:wihCgS506gI98gWNlPTGQQm6agrdmbF6LF8frGz5o:wDO6oNtTirdsdjso
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEX2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe 5008 LEX2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 5008 LEX2.exe Token: SeDebugPrivilege 5008 LEX2.exe