4e75a73cfc2789cc0753d2fa3fd49f80b2633f55360e7d12cf0134add3e5ad53

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e75a73cfc2789cc0753d2fa3fd49f80b2633f55360e7d12cf0134add3e5ad53.exe
Size

83KB
MD5

5da4c01266d23a62f3f2be6a8ba83af3
SHA1

f152eb652f27886aedfb71def5e452a738ee9075
SHA256

4e75a73cfc2789cc0753d2fa3fd49f80b2633f55360e7d12cf0134add3e5ad53
SHA512

8f762cb894bf9650935e11fdcc5a6b08ef5bb3051cd0f5c35228da5f9fb8117ec45f0d2860bec434b39628a841160644f6f388bcb7712c2ac0e51720f4078e9a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2960-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2960-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2960-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2960-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2960-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2960-28-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e75a73cfc2789cc0753d2fa3fd49f80b2633f55360e7d12cf0134add3e5ad53.exe

C:\Users\Admin\AppData\Local\Temp\4e75a73cfc2789cc0753d2fa3fd49f80b2633f55360e7d12cf0134add3e5ad53.exe
"C:\Users\Admin\AppData\Local\Temp\4e75a73cfc2789cc0753d2fa3fd49f80b2633f55360e7d12cf0134add3e5ad53.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-weC2giJsp9uAzotj.exe

Filesize
83KB

MD5
11ffd1a951b277a01d4f2478fd1164d0

SHA1
6eb99e5c285ab548d0d900f1e5b2e09684ce8ccd

SHA256
d22424d2c7ba13d69045dfc4bdd05f9893bbbe3af2b0e7afeafb2da93eb3a60c

SHA512
dff2ee688f672d383a74fbaf702de7c3b19c47ebba01178e2f5947d9fe5bd7d54c3d26a8b15386c9b8ecb3f533445e6d53c7faab8730581fe183a825e32956e7

Download Submit
memory/2960-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2960-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2960-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2960-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2960-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2960-28-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download