8e30cb4446d43a41cb78dbbf3f8801885c6b012e3605401f262b0efdb182339a

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-08-2024 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e30cb4446d43a41cb78dbbf3f8801885c6b012e3605401f262b0efdb182339a.exe
Size

83KB
MD5

997547a106216e2ca791c135e8b524fd
SHA1

f1ba3b7276fed285493870cccf575885e6bf2d9a
SHA256

8e30cb4446d43a41cb78dbbf3f8801885c6b012e3605401f262b0efdb182339a
SHA512

353444a9e0c36bbcf0342313817b8c0ce3a95be912760ad7b53383b84a606cbf7f6aba1a115199fa6d3aec3187705439c1f5b44f8a6c69ec50dd0d0baf4eee94
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+GK:LJ0TAz6Mte4A+aaZx8EnCGVuG

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2536-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2536-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2536-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2536-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e30cb4446d43a41cb78dbbf3f8801885c6b012e3605401f262b0efdb182339a.exe

C:\Users\Admin\AppData\Local\Temp\8e30cb4446d43a41cb78dbbf3f8801885c6b012e3605401f262b0efdb182339a.exe
"C:\Users\Admin\AppData\Local\Temp\8e30cb4446d43a41cb78dbbf3f8801885c6b012e3605401f262b0efdb182339a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-LIHX5dxLcWvM34iE.exe

Filesize
83KB

MD5
f20b5a662d139f935f3a698f20dc13f8

SHA1
aedf8b6b01731078baa9181b2d62a800f8004980

SHA256
3c0ecc1ccaaa92ff371c10104fc44599cf8bc99e9ad58851f0a0d136e55f09cf

SHA512
d965a29af2c3bf3ef3e8480c832769d56328dfd9c6e20e112c430bfaf90d35769b3a510f215f3c698aaa153e62a95ca1decfa6ee0b4f31a686b9eb8c5d3ccf50

Download Submit
memory/2536-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2536-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2536-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2536-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download