5d40a3e0362b4ce2cbc77219e9b9c56f721aeb3f304c12e9fc3867597b86bfba

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d40a3e0362b4ce2cbc77219e9b9c56f721aeb3f304c12e9fc3867597b86bfba.exe
Size

236KB
MD5

2f2bce4d1af0b306cd12d5c8a630ff07
SHA1

fa0375b23a1aa66451429e10f08c5a3821cd9ca1
SHA256

5d40a3e0362b4ce2cbc77219e9b9c56f721aeb3f304c12e9fc3867597b86bfba
SHA512

3f67f65d4b9b1bcccd304fcd392d3338aefb1655a103f3e8185899415f34b014cbcac3ccba520399664c52b7b7a7f100d32199e31a087c7d90192e3cd3716ce7
SSDEEP

3072:DJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/V/FnncroP9:FwDeM7iNEkgiOb31k1ECRJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4668-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4668-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000e000000023351-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d40a3e0362b4ce2cbc77219e9b9c56f721aeb3f304c12e9fc3867597b86bfba.exe

C:\Users\Admin\AppData\Local\Temp\5d40a3e0362b4ce2cbc77219e9b9c56f721aeb3f304c12e9fc3867597b86bfba.exe
"C:\Users\Admin\AppData\Local\Temp\5d40a3e0362b4ce2cbc77219e9b9c56f721aeb3f304c12e9fc3867597b86bfba.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-VHyZVRvhcflJuQky.exe

Filesize
236KB

MD5
f68fc66fc69f918731f068fa3629389d

SHA1
3bcc3d310c4477536afd9a1457821d1997264d22

SHA256
b0d0822765bf1dd23d0b77a77f39dbdc8f4e8af7cdc8d5e82811f9c91bf48a7e

SHA512
32dc36917cef2771ff6695b3d0dd052c5cc8c08d90c852947f2fa7b05747be192935185a4ab1dc17e240750622143fd25607cd9ef185cec1b8438ed7cf06754b

Download Submit
memory/4668-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4668-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download