dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe
Size

236KB
MD5

58d201993e68a0c7cea7bba58646311f
SHA1

9bdc98de9724d5e9896b3a1c96dcd86b2eceae07
SHA256

dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30
SHA512

fc9c9da62dc1eed8ad6e1ffebe8b33e243e8e335dc14135f969c702c83bdb26764edea6e54eb369ac76af384ba3f013c94e5a01f3192b330df34d7043b678675
SSDEEP

3072:aJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/w/FnncroP9:uwDeM7iNEkgiOb31k1ECeJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1664-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe

C:\Users\Admin\AppData\Local\Temp\dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe
"C:\Users\Admin\AppData\Local\Temp\dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-l2VStxYFmhFKUY3V.exe

Filesize
236KB

MD5
e9e67a914e00dc48f188db4efd6910d2

SHA1
b8529cef6a5a181fb5ac0ae300c84c6f02228f29

SHA256
b6f7159f684ab22fc6ee81d575b92ade944e29284c5b14ab4cd6536372bfba8f

SHA512
5210366523964badda350827a74968b142194ef04ea837703385f2217f01032c84fb86ec5fec050a9f9f9166aa4d7594c5ef5d0bf0ff9c00aa5061283c3b2754

Download Submit
memory/1664-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1664-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download