f883d92dbbb1aaae11a268fbca0328db1813df1a5e06046ee0bf7aaad08eb78b

Analysis

max time kernel
141s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f883d92dbbb1aaae11a268fbca0328db1813df1a5e06046ee0bf7aaad08eb78b.exe
Size

83KB
MD5

6d9a4cae00f7edb8afd3e72f916ed013
SHA1

01df9547012158710e8a468afe9430387d7fcf9b
SHA256

f883d92dbbb1aaae11a268fbca0328db1813df1a5e06046ee0bf7aaad08eb78b
SHA512

1b30f8040564dd078ee3db352e91719c66fb185b02c4b3ce8b75ddfe681761b7d829e4004093f607cf4ca701fd9be33c590cd990ec2cbe3d48045ddd0e31ba4a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3248-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3248-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3248-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000a0000000234c8-11.dat	upx
behavioral2/memory/3248-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3248-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3248-28-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f883d92dbbb1aaae11a268fbca0328db1813df1a5e06046ee0bf7aaad08eb78b.exe

C:\Users\Admin\AppData\Local\Temp\f883d92dbbb1aaae11a268fbca0328db1813df1a5e06046ee0bf7aaad08eb78b.exe
"C:\Users\Admin\AppData\Local\Temp\f883d92dbbb1aaae11a268fbca0328db1813df1a5e06046ee0bf7aaad08eb78b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-8O9QtUo3Trkjvtpu.exe

Filesize
83KB

MD5
dcf95c9b6beda3cbc707aaeb9f327d15

SHA1
a9b6f9d7a520038b91659161cb1425534d9f1ac8

SHA256
b2ee9f35953b21a02d18513dfb91eb5cb9d6d97901f9963b585318c018f2973c

SHA512
0fe62196537c4284f8259ff5441fa91e4109a626c6c7b6c99d114f9385183276ec2b9e9a6426f2b6766228935a2f328c949de51d13304e0621e599142f5f8717

Download Submit
memory/3248-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3248-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3248-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3248-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3248-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3248-28-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download