fce9315b90bfdddb4febda44a0c4ce2ceaecba1463d5c3db51e17852885aaf32

Analysis

max time kernel
111s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6acc2ef8f2f9f082820fd16ba99cea00N.exe
Size

83KB
MD5

6acc2ef8f2f9f082820fd16ba99cea00
SHA1

6f2f464b5955ecb9b1a2bb141d68041b2688d7c6
SHA256

fce9315b90bfdddb4febda44a0c4ce2ceaecba1463d5c3db51e17852885aaf32
SHA512

6835bacd48f8112bf7bfb5d71cf4680e711de24d5c8c8a90abc0312d7bc443f7e5600eb26b8e357f23385c6f4e193ef6e33d94357d85b074c8b60e658c3d2630
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+cK:LJ0TAz6Mte4A+aaZx8EnCGVuc

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1840-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1840-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1840-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00100000000233fb-11.dat	upx
behavioral2/memory/1840-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1840-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6acc2ef8f2f9f082820fd16ba99cea00N.exe

C:\Users\Admin\AppData\Local\Temp\6acc2ef8f2f9f082820fd16ba99cea00N.exe
"C:\Users\Admin\AppData\Local\Temp\6acc2ef8f2f9f082820fd16ba99cea00N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-bmEgC6u1JX550hPQ.exe

Filesize
83KB

MD5
cec7dfb22284fb7731fd82ad6aa43d41

SHA1
f9f5ee5f3f39bbd5e70f9dfcf7645c2b728922f4

SHA256
172fe05091172acbd4bfae22b4f644e08a6086325d94cfd320c3de1ec9f86fc8

SHA512
2da2cf6c82b298e82f7c391aac9250e1f8e2fc0872ce08a3f459cae1aa6ef6e84744f3293f44fd37a1e94cd404b5b772e93cb86e6b301fd6d57b5b463008f51f

Download Submit
memory/1840-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download