531a633443831b20a4a72cde2bf62b0993116f11cced151f053d1c41c3767c3c

Analysis

max time kernel
90s
max time network
95s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

054f48b6b2d1d2a3ed863cb7182a5810N.exe
Size

236KB
MD5

054f48b6b2d1d2a3ed863cb7182a5810
SHA1

11b5b9f7f58254677113f4a305cdd245c8035245
SHA256

531a633443831b20a4a72cde2bf62b0993116f11cced151f053d1c41c3767c3c
SHA512

45eec5001d2bbd94c4484047ce3ff11a964e570518434b7100a507a0e9b67534b11fab419511df54ed9b6473ee9047907b1c33766acbf49b1c11a2639f4bc0da
SSDEEP

3072:dJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/R/FnncroP9:HwDeM7iNEkgiOb31k1ECNJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2480-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000400000001173a-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	054f48b6b2d1d2a3ed863cb7182a5810N.exe

C:\Users\Admin\AppData\Local\Temp\054f48b6b2d1d2a3ed863cb7182a5810N.exe
"C:\Users\Admin\AppData\Local\Temp\054f48b6b2d1d2a3ed863cb7182a5810N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-tThdqo2EwjEFqJtJ.exe

Filesize
236KB

MD5
68143e17f56fc1f5b838c4e4c74b2366

SHA1
90d2e8c8a24aad5213e34c2c0077e13bd933d41a

SHA256
e3ff355dd935bf1e28d3ddfbd00a6906eee27f3c786425b507922d3fe0638a59

SHA512
331bfe517a045f9d67469036b1b9b6c2401add0753b2aa929db6c6ab8bb31d28ed408e84a7f7032b09d2920b1528095d28de302459d725a170b8ee8ee21bf9b0

Download Submit
memory/2480-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2480-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download