e74ea385cdbcb5639f83f554312ed4f45f4710c7e601406d3b409731686b2a6e

Analysis

max time kernel
91s
max time network
96s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

119acc48f52cd3bfc24804e3cd77dbe0N.exe
Size

236KB
MD5

119acc48f52cd3bfc24804e3cd77dbe0
SHA1

94d168fb264fc66997bec9976816a98ad328e821
SHA256

e74ea385cdbcb5639f83f554312ed4f45f4710c7e601406d3b409731686b2a6e
SHA512

f4f321dc6688309da0a42f7d5e865a74e48ba789e7cf62e172466b1b70b24f2135836fa8e78baa3012321bfe805f450c99c3cdc48614b88ffea2144e29ec2c71
SSDEEP

3072:pJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/t/FnncroP9:zwDeM7iNEkgiOb31k1ECZJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1924-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000f00000001270c-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	119acc48f52cd3bfc24804e3cd77dbe0N.exe

C:\Users\Admin\AppData\Local\Temp\119acc48f52cd3bfc24804e3cd77dbe0N.exe
"C:\Users\Admin\AppData\Local\Temp\119acc48f52cd3bfc24804e3cd77dbe0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-WLzelIOLI4dCElpz.exe

Filesize
236KB

MD5
a8c1d79415144ee27382129a3dae3f4f

SHA1
36d395882ef32e340a30d92789827178188c5d6a

SHA256
94a1c6ca03213536e751316298411ea309c9e80e35824c894d35f87ffb12bc2b

SHA512
5ecca41f1a34703de7d30de6168e498b17cc6545b4d01a96a9c01916251419c0c51add060aeda8ab4f14e26cdabea85abdff2a6749a4270b31ee954e0ad75501

Download Submit
memory/1924-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1924-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download