e7547181ee6b9bddb3e9953adfafcb32a44acd46bae5fdbd6021da585c81b40b

Analysis

max time kernel
111s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e92aa8a1e863b2b9bcb2a601c18182f0N.exe
Size

83KB
MD5

e92aa8a1e863b2b9bcb2a601c18182f0
SHA1

65535424b7217c58c807c1ddc50a1c89efde469d
SHA256

e7547181ee6b9bddb3e9953adfafcb32a44acd46bae5fdbd6021da585c81b40b
SHA512

a3db946f6b02996c5e1d38b1509764261c07b99227949d7414b5c9a240f20410e0c24e122ed18cfa69f2833e9fa150e6ccebc9bb9b7aa3562f2748a476edd3b1
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+kK:LJ0TAz6Mte4A+aaZx8EnCGVuk

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3300-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3300-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3300-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0009000000022aa5-11.dat	upx
behavioral2/memory/3300-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3300-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e92aa8a1e863b2b9bcb2a601c18182f0N.exe

C:\Users\Admin\AppData\Local\Temp\e92aa8a1e863b2b9bcb2a601c18182f0N.exe
"C:\Users\Admin\AppData\Local\Temp\e92aa8a1e863b2b9bcb2a601c18182f0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-qrDVlZ1p4gE6xZaD.exe

Filesize
83KB

MD5
b91ebf1d4890513d549135f10c3234d7

SHA1
e439d9f387b00cdd570ac7aee689edb8064bd6a6

SHA256
7d4f67082e9a9b45d7b4a3461b09cef446cf230f7a03cb990f4705b7323d1fe6

SHA512
c34ea69d977ad4586a80159ad957186f2702fe127df623c1ccf9d5e7c3031f16e1d3945eaeb7f422bae3c3fdd8a349ac89eae20109aeed736f3542bf8d2c3fee

Download Submit
memory/3300-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3300-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3300-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3300-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3300-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download