db02e841ad39549957792c4c6e526209003a081a767b4ceb6b5a3954b0cbd4af

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53c376cff4fd2fd08bd6d5f5a2e28e40N.exe
Size

83KB
MD5

53c376cff4fd2fd08bd6d5f5a2e28e40
SHA1

5307aee6ac2a34ed07f0eb3384cee4f8e401f3b8
SHA256

db02e841ad39549957792c4c6e526209003a081a767b4ceb6b5a3954b0cbd4af
SHA512

37b6c45b199b5c329e6e738867bb4868fb2d5f87aa132fd1adab5cf90f0dcc9e25ce71a8f40b6be40a6a383b6ee2c842d2df775bf8b4d37dbe8cd894b328d79b
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+ZK:LJ0TAz6Mte4A+aaZx8EnCGVuZ

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1320-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1320-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1320-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1320-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1320-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53c376cff4fd2fd08bd6d5f5a2e28e40N.exe

C:\Users\Admin\AppData\Local\Temp\53c376cff4fd2fd08bd6d5f5a2e28e40N.exe
"C:\Users\Admin\AppData\Local\Temp\53c376cff4fd2fd08bd6d5f5a2e28e40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-DTiwTefYCQ8JNfHU.exe

Filesize
83KB

MD5
35bce5f51099b7eba3a365b4f862c937

SHA1
6204a60329516f89d9aa8ac77d03242c43d03ebb

SHA256
8c3fd33ca65c20f416c6fbc194793ff138eee5633324e2f41afab85914bebcd2

SHA512
fb37cbd618a0ff459792142b130216b0c9513ef6c3d67e89f5e5ec12fe8888209a9862143ddaaaeff0b35225ff1beb50ff1a55c709ddce7420755a09f5b463be

Download Submit
memory/1320-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1320-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1320-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1320-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1320-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download