Analysis

  • max time kernel
    110s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 15:43

General

  • Target

    a90b3b50d6203575bcfdf22ee1d881e0N.exe

  • Size

    83KB

  • MD5

    a90b3b50d6203575bcfdf22ee1d881e0

  • SHA1

    28bbfe947e2dbe8198ea66c017a9729a1d70d992

  • SHA256

    9860336f345a06f36059902f0643a4e986b0ecc5d31fdbd6817b18a461ad1460

  • SHA512

    5aed2f774950832724c6fed80aeac1cdd57c0a59728c59beb28b74bac0f7bb3d0b94e5377401ec9525b673a6599593a0dae6e4b963e39e1d94afd9ca08a51cee

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+6K:LJ0TAz6Mte4A+aaZx8EnCGVu6

Score
7/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a90b3b50d6203575bcfdf22ee1d881e0N.exe
    "C:\Users\Admin\AppData\Local\Temp\a90b3b50d6203575bcfdf22ee1d881e0N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4028

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\rifaien2-bbzSPIDquHZ2hrkk.exe

          Filesize

          83KB

          MD5

          6b8c38199578d9374534f9b9b9ed92ac

          SHA1

          02efe53cd1dd854aa17f1faf936db44f12bb89d6

          SHA256

          4343193b94b98cc832cb825bdfe2cceb5db03439b3066906e8661c4be0ec7988

          SHA512

          25d86eb73d7d99c3beaacc05c96f22b822a4e042b102da62419096d21fe4ba76ff23b83667849c9a4751414d9239e892f239f385ad3cfd1340200999231877dd

        • memory/4028-0-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/4028-1-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/4028-7-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/4028-12-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/4028-21-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB