dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe
Size

236KB
MD5

58d201993e68a0c7cea7bba58646311f
SHA1

9bdc98de9724d5e9896b3a1c96dcd86b2eceae07
SHA256

dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30
SHA512

fc9c9da62dc1eed8ad6e1ffebe8b33e243e8e335dc14135f969c702c83bdb26764edea6e54eb369ac76af384ba3f013c94e5a01f3192b330df34d7043b678675
SSDEEP

3072:aJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/w/FnncroP9:uwDeM7iNEkgiOb31k1ECeJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5000-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/5000-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0009000000023385-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe

C:\Users\Admin\AppData\Local\Temp\dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe
"C:\Users\Admin\AppData\Local\Temp\dc2f24b4f9042e51b0796881979a76b83dc95f17887056dd6bf9e563b8297e30.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Mg5nFMpqdIJTOe6r.exe

Filesize
236KB

MD5
30ca75609903c08882e42d08fe774ba4

SHA1
99fc812eaaa456c55ca96480418383f9329d2fbf

SHA256
af01cd78db618720eeb7ee8d62bef75525369d9eca53f7486e72cd65edf03d2b

SHA512
f5da4601d1b6103c205181df1db84dcccbaab3c8603e9e2db41f269e3a998864c45b814baad315f2004b68829884f76088fc7956eb00d42dab4d58643672f8f4

Download Submit
memory/5000-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5000-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download