Analysis

  • max time kernel
    112s
  • max time network
    91s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2024, 00:09

General

  • Target

    20e61d7f958d0c82e5c59ff3e8e91a90N.exe

  • Size

    83KB

  • MD5

    20e61d7f958d0c82e5c59ff3e8e91a90

  • SHA1

    ce2b7b2ffe683ca36b6f30ef8c3511dcafbbaa9f

  • SHA256

    66615cf8d51124f631c60d80868043d68dedb08227f2498ec83da559f0e55444

  • SHA512

    f29da8c5230b9d7a782d1d45c342125ac8e0da8cecd3c09f2571c96822fee45ab38cc6b7afc3d6d00e3c2100e2757ea89854a63c766bcd4f308511eeeeb67687

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+XK:LJ0TAz6Mte4A+aaZx8EnCGVuX

Score
7/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\20e61d7f958d0c82e5c59ff3e8e91a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\20e61d7f958d0c82e5c59ff3e8e91a90N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-RT4qc9oe8DsKVxZk.exe

    Filesize

    83KB

    MD5

    3794aac07ddb267410926917f9f31b49

    SHA1

    be8f471ab4df9a9c0a79e9719d01cb91b63e5507

    SHA256

    75dfb4c9e0066dc6063ce320fd3d3d2cf6db19d1caca13c93f64fc5ee1ed0b3a

    SHA512

    abb7abdce72c8181dc329b6bbd5f18cd953ecf1858745d7377f66aaf7852604185c6a0e8fab249b84a87cfed5b65b23093db64c80321fd9a8dc03545dcb75e37

  • memory/2064-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2064-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2064-7-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2064-14-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2064-21-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB