221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97

Analysis

max time kernel
120s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe
Size

236KB
MD5

8acd209b41bd998b0fec39aa31211f33
SHA1

07f1dc8e7085674b708fea918d54cfb406e47c79
SHA256

221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97
SHA512

75c504f4d2c05cb1ddd4fe37758b1ff1826594979f15534dd81aecb6886fac81c5f3429ff2e02043ce1aada3044d9d83e201346fee9b89de4d6a5bf96ad5b02e
SSDEEP

3072:zJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/6/FnncroP9:1wDeM7iNEkgiOb31k1ECMJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3408-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3408-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000300000001e76e-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe

C:\Users\Admin\AppData\Local\Temp\221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe
"C:\Users\Admin\AppData\Local\Temp\221efdc47915b15789650fed168b9919b9a3796a2ed7732827f361b6a18fdf97.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-SktcDfcBb7j1b5mC.exe

Filesize
236KB

MD5
9198649acb51835bc266fa4beeba8f8d

SHA1
2126f0f27c86b348271f5ea9529195a8523d86ad

SHA256
1c86f64d09e34819e153d50f0aa1407d425e4770408abb1bb3c1780899e0cb32

SHA512
a959305786483f142eb722262369921213b61e44f76c80abbeedbb48c0bad3bdf3a64d1e58ec49fcef105a78fc0b8eea9fc07674993a73aa9f56398f1bc8b694

Download Submit
memory/3408-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3408-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download