f1db4c76ede255cac379415255f2874a76d1d4391986d5b43fa61b3197246d13

Analysis

max time kernel
110s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27bacd63eaca4aaa93380a258492b550N.exe
Size

83KB
MD5

27bacd63eaca4aaa93380a258492b550
SHA1

9a53be0b5e0abd001c208a9420bc7edc3c9aaa0a
SHA256

f1db4c76ede255cac379415255f2874a76d1d4391986d5b43fa61b3197246d13
SHA512

ebaa75400bdb8785acd2e03f1f85408061471dd9afae96bd85ff266b93f52ac0e7b33db401ed16a7d941c7d466a47d3aa70a9cf3267615c23bf8babd33c0c04f
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2188-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2188-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00090000000234be-11.dat	upx
behavioral2/memory/2188-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2188-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27bacd63eaca4aaa93380a258492b550N.exe

C:\Users\Admin\AppData\Local\Temp\27bacd63eaca4aaa93380a258492b550N.exe
"C:\Users\Admin\AppData\Local\Temp\27bacd63eaca4aaa93380a258492b550N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-drbeajxdRW7d8WSp.exe

Filesize
83KB

MD5
e8e79ea9e877a61e579d49d277da05dc

SHA1
7e87ac52a65ca326adfe4e3a6fe3a974c82d0044

SHA256
129a51a971de55d30188a0f5acfe4b15ec1a3e768ab43560bdc703f615e61fd2

SHA512
78f1a69b2a644a0685300350f5d48289b08921b645f7650745f0fba436746b4bf994abea0d03ebfdca21373f61d35eaccaa8fe8e71ef9c5e842e43cc0faf44bd

Download Submit
memory/2188-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download