f815908e60e957c7b860e853730d809c0c10a061a220e43d2af9a0d6861b5596

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03-08-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

314b83b6f4bb38a5ef7e7a3d3c0754d0N.exe
Size

99KB
MD5

314b83b6f4bb38a5ef7e7a3d3c0754d0
SHA1

c0a2a32d508e657640e37291b064685c5af1b722
SHA256

f815908e60e957c7b860e853730d809c0c10a061a220e43d2af9a0d6861b5596
SHA512

fe228a8c119c8a5218d073bf98e5e70e3ef4d22dbaf9fef147349a9e2f69a491c5d0da3ce4ddbaf572b6d14cfb99b2f5a871609e3e3afaabd730bdcb5391817f
SSDEEP

768:xGvbqsQdX5BhGEnOsIzfJ4i4g5p0syi+hvN18K3H8T6++3KI4Fyu8hcLCik5dAyU:szqsQ5PIt4+/yfeB6r6YcOik5h36lX

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2564-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0008000000018c22-5.dat	upx
behavioral1/memory/2564-101-0x0000000000400000-0x000000000041B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	314b83b6f4bb38a5ef7e7a3d3c0754d0N.exe

C:\Users\Admin\AppData\Local\Temp\314b83b6f4bb38a5ef7e7a3d3c0754d0N.exe
"C:\Users\Admin\AppData\Local\Temp\314b83b6f4bb38a5ef7e7a3d3c0754d0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\Valhalla Chronicles Patch.exe

Filesize
99KB

MD5
8eb572615710e96cd2d4486cc1675c66

SHA1
08ab1f1d1c7909db57f5a4357a97e9694ded316e

SHA256
4e67f8a24b21eef98c1e45ad2a219deaa54bbf72e6984753b661c736bf731b65

SHA512
90b8b029d514cd13d0dd7b3e6228e9b208ad7129431be7b0076e2eaeeb3a61105b662d4229649b67bee40788614fac184fc682f8a62469408e1fb3a88dc84802

Download Submit
memory/2564-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2564-101-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download