e27fadb38f6ea18f62f4973b8b063596635d31046baa205723cf8b0bf7b568b9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69b5077b041176fa7c0c30d982ddf560N.exe
Size

83KB
MD5

69b5077b041176fa7c0c30d982ddf560
SHA1

cbb928076d67d100ed8e5e997e411b6ab1ca0302
SHA256

e27fadb38f6ea18f62f4973b8b063596635d31046baa205723cf8b0bf7b568b9
SHA512

bd220924ef04ec9e2e6ea07e1a9a9ad3a37c45eb332523f57c9eb4a1d385333e0de45bd83109f182459ccaacde02f83ded62d79cd91a4928c3bf2457a8a40933
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+2K:LJ0TAz6Mte4A+aaZx8EnCGVu2

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1848-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1848-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000a0000000120f1-11.dat	upx
behavioral1/memory/1848-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1848-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69b5077b041176fa7c0c30d982ddf560N.exe

C:\Users\Admin\AppData\Local\Temp\69b5077b041176fa7c0c30d982ddf560N.exe
"C:\Users\Admin\AppData\Local\Temp\69b5077b041176fa7c0c30d982ddf560N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-ec4YtoATEmFkhP4N.exe

Filesize
83KB

MD5
c965f898579111d80091149ee9f3d104

SHA1
a715752ee16917ce5a078d6a1bc3232a8b91bead

SHA256
d78f9eec69bf9b124900bebd5a5c752c277410b60f953a6913951eadec242fa0

SHA512
28091adaac8511199992a8826b6ab948791cb3db8a1668a3213affeafb3373b7631fc88816c091e1efb9cd5b47a9e5badaa1b3dacc934b90135cac9a37f8939e

Download Submit
memory/1848-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1848-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1848-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1848-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1848-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download