221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe
Size

236KB
MD5

8acd209b41bd998b0fec39aa31211f33
SHA1

07f1dc8e7085674b708fea918d54cfb406e47c79
SHA256

221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97
SHA512

75c504f4d2c05cb1ddd4fe37758b1ff1826594979f15534dd81aecb6886fac81c5f3429ff2e02043ce1aada3044d9d83e201346fee9b89de4d6a5bf96ad5b02e
SSDEEP

3072:zJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/6/FnncroP9:1wDeM7iNEkgiOb31k1ECMJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2476-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2476-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x005200000000f5ab-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe

C:\Users\Admin\AppData\Local\Temp\221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe
"C:\Users\Admin\AppData\Local\Temp\221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-w9Ou3sDSC5JXQ1jP.exe

Filesize
236KB

MD5
ba2ed9ab0489491b03303e3b116d72a6

SHA1
966a54692983d7e11920312737654a05573e1b13

SHA256
9a8d1c42cd275dbef5cec5360bd21e19ce532fb98d1ec9336710404d7817a378

SHA512
bfb6c2dc2c59a847f4c2953cb6e2e43e33493667d92f7fd8d2b479796fe2f0a42cd83a0bb6f5a4d9bf7e0ba3d14d346877e17188b4c19a951fb4b2d2c98bce72

Download Submit
memory/2476-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2476-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download