Analysis

  • max time kernel
    110s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-08-2024 20:56

General

  • Target

    031b5d9c1c09ad58b4cc90b52226c420N.exe

  • Size

    83KB

  • MD5

    031b5d9c1c09ad58b4cc90b52226c420

  • SHA1

    9c762dee74839ebfca772eba4f721b6f02ce3a1f

  • SHA256

    0c9d5dea8c42b46d360d6783a2447a268be0e3d8fcaec98359850ff2c760265c

  • SHA512

    d514f1122dbc8661ad78e14b4cfa1a21fd6827360365522933c777c5896da2b91cf3b58724220c760c7b839ed5e9901edc6685e28a7f46c59f2c0d51c3072115

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+8K:LJ0TAz6Mte4A+aaZx8EnCGVu8

Score
7/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\031b5d9c1c09ad58b4cc90b52226c420N.exe
    "C:\Users\Admin\AppData\Local\Temp\031b5d9c1c09ad58b4cc90b52226c420N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-EenoJT78MJhDwKgo.exe

    Filesize

    83KB

    MD5

    f27ddfa6bfc97f2892fda2d6d19496c2

    SHA1

    4dbd440190e410b7b07cfa2e161a74d3ad9b38e5

    SHA256

    7c4ff31e8ebb158c31078920b80df723576401751627e5bf9d249ff39f855692

    SHA512

    1b5add9d52c35f71fe3f00270fb99e22a561148e7eebf18483390eb16255cf13a3ef3a1c274654491239229fdac7215972f3c3055538f9cb3fd8af200ef03b3f

  • memory/2564-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2564-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2564-7-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2564-14-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2564-22-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB