Analysis

  • max time kernel
    110s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 19:20

General

  • Target

    dc16514cd5cdc6b433f3cc3dc2936b00N.exe

  • Size

    83KB

  • MD5

    dc16514cd5cdc6b433f3cc3dc2936b00

  • SHA1

    461560eaeb2b570e782b2abda4b21c9776acb5e2

  • SHA256

    e4d86f5304ef5caea3d413085c8a45d6025f5128c483711ef105c0e99796315e

  • SHA512

    40e36bf637beb7856659017d49882f9340033a0c8452a01cbd7c6520cf0ee7480c030a0c849b73cb0d3658a9eabe2fac785b7008e4136fc6f631b9b83864a973

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+yK:LJ0TAz6Mte4A+aaZx8EnCGVuy

Score
7/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc16514cd5cdc6b433f3cc3dc2936b00N.exe
    "C:\Users\Admin\AppData\Local\Temp\dc16514cd5cdc6b433f3cc3dc2936b00N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-w1pzhpl9Fp8sMfgA.exe

    Filesize

    83KB

    MD5

    334e2c6c2c2d6be961f06f1aa815a6df

    SHA1

    6f4eecc0504a21d6efe0f86faa11fb267e5902ad

    SHA256

    afad6c68a9863b7825e887d22da20bd2451d2b0d0c378bfa1f6a96de98b88b44

    SHA512

    a8095f396546b7223bd047d1ef6a5ab6f06bb11dbb1e1bf5ed59b06a275e6c53f4c255104529a9f78360e88064bb98bb0f34b8512969bce5cc8f0128ff98b395

  • memory/3608-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3608-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3608-7-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3608-14-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3608-21-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB