Analysis
-
max time kernel
140s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 05:40
Behavioral task
behavioral1
Sample
ef990fdb53f3ff0b517fc756499c02167cf06d2d1e5fc61d59d3e1f4607e6785.exe
Resource
win7-20240704-en
General
-
Target
ef990fdb53f3ff0b517fc756499c02167cf06d2d1e5fc61d59d3e1f4607e6785.exe
-
Size
83KB
-
MD5
3ed9b03fccd642ec8a9dde26b45c7f36
-
SHA1
b4d26c6fa00bcbc37295184b6431d98e6805bc42
-
SHA256
ef990fdb53f3ff0b517fc756499c02167cf06d2d1e5fc61d59d3e1f4607e6785
-
SHA512
c73f1ab14cafd67b6034a811b81155882cc151fd74766749ea6550f7c0bf141e8bfbc1c810e41ee97d501ebbcb4586a8b8f98c2a03eadd52c2ee09157a981644
-
SSDEEP
1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+wPK:LJ0TAz6Mte4A+aaZx8EnCGVuwP
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2700-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-5-0x0000000000400000-0x000000000042A000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\rifaien2-Qu6fHdwiqN89KN9Q.exe upx behavioral1/memory/2700-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-28-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ef990fdb53f3ff0b517fc756499c02167cf06d2d1e5fc61d59d3e1f4607e6785.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef990fdb53f3ff0b517fc756499c02167cf06d2d1e5fc61d59d3e1f4607e6785.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rifaien2-Qu6fHdwiqN89KN9Q.exeFilesize
83KB
MD5375af3cef23ed304ef9f68324fed1949
SHA16076455e03d57c637553fd2d61267a15c8765b9e
SHA256fa4876847fbf060fb023ca1642ff318f9223a60d7b754c8ba3886933ad8520b9
SHA5121b52457bf06dad0f3b1101768a6f83c08407b6f0ec48b17930bc82f74ce8fb5c3482592f2125a0dd35eb99d40561800a5902f022ba351270ee99fcbf2ac8ce7e
-
memory/2700-0-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2700-1-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2700-5-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2700-12-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2700-21-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2700-28-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB