0d1c577ff9b954a15024d04d30369db9f02f15674ae582e9088dfed571acf127

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a8bee06337f77fc931606b564f173e0N.exe
Size

83KB
MD5

9a8bee06337f77fc931606b564f173e0
SHA1

bcafe03023a7415693e08af978283bdce6ce6c1e
SHA256

0d1c577ff9b954a15024d04d30369db9f02f15674ae582e9088dfed571acf127
SHA512

532843086bb161031265028f0f5e05c2754104ac188d2811a51cb1456cb0effa44451031c8e5ed72b300a239498bd9805aadecbe8d837c2f96e5e9b77dbdd2bc
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+jK:LJ0TAz6Mte4A+aaZx8EnCGVuj

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1968-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1968-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1968-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1968-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1968-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a8bee06337f77fc931606b564f173e0N.exe

C:\Users\Admin\AppData\Local\Temp\9a8bee06337f77fc931606b564f173e0N.exe
"C:\Users\Admin\AppData\Local\Temp\9a8bee06337f77fc931606b564f173e0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-ysCFkUPTOztFGKMv.exe

Filesize
83KB

MD5
7aa3b8fcebe220e72299193be07d9699

SHA1
2f53fd585b36d40fa553253a8199e341eaa2082b

SHA256
110fea4b2e408bb26bfa5dd96890b8350ce080cca1101cd2a3339e8cf7086779

SHA512
8833673ab3983ddcca3076058d4999f4aa396512c278ae6a1defb82f9d860f69b390f61f3006c29fd8034cda1bdbbce3fe51e3ab265e2a93f0fe434c6a1e9040

Download Submit
memory/1968-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1968-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1968-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1968-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1968-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download