c25f839b1403e9eeb4b235c7af663201c7ea395aa3e3db20f594f3a20dd815b1

Analysis

max time kernel
91s
max time network
95s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-08-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49b4389334124737a4513ec9b64e73c0N.exe
Size

236KB
MD5

49b4389334124737a4513ec9b64e73c0
SHA1

8944cb40c5dfa225b0150b87589b2fe034164081
SHA256

c25f839b1403e9eeb4b235c7af663201c7ea395aa3e3db20f594f3a20dd815b1
SHA512

f539bc0e8aa6056e3cde63127741467dfa6367df0299b940f9c15065c01775f712a27ab0a6720eea91b03b1c93bec4c8b9438182cf5f027f787721c9ee3c2d0f
SSDEEP

3072:4J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/Q/FnncroP9:8wDeM7iNEkgiOb31k1ECuJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/708-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/708-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000a00000001227c-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49b4389334124737a4513ec9b64e73c0N.exe

C:\Users\Admin\AppData\Local\Temp\49b4389334124737a4513ec9b64e73c0N.exe
"C:\Users\Admin\AppData\Local\Temp\49b4389334124737a4513ec9b64e73c0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-mfm6KW8PsgwHwv1C.exe

Filesize
236KB

MD5
478c65d43915d0a8beb8bb8caddbd68d

SHA1
ec39191c12d4c5308c5574db6a58b44a5f8dfe6b

SHA256
71ba6730260ee91fb9e06649f2388d216852ade6b14fd00e91fd1afb933d8032

SHA512
8775d68559b665a605c9af1efe4d065e53f62ee12a7cc6fd3c5de95eed572b2a07ed88efec73c51fa73d440a1ff70d428cb4196e84592de9ccc08c6b5b1fb9b5

Download Submit
memory/708-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/708-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download