34c45a34d9bbd3c7ce3b8c0e64d2068d592c46a3123e10cfc61d73b331ecf9fd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

34c45a34d9bbd3c7ce3b8c0e64d2068d592c46a3123e10cfc61d73b331ecf9fd.exe
Size

236KB
MD5

1137e187d4c7f0ff8e2bd541363cc4ee
SHA1

fbb157f06067c818b32aadecb799869cec8eb477
SHA256

34c45a34d9bbd3c7ce3b8c0e64d2068d592c46a3123e10cfc61d73b331ecf9fd
SHA512

5de230ae359a6a82d76e3f840e9a5cc9265a4bdb944c29a7c258d348b107d40e2a55c02d1dcd2cd356d1bb77a5f6a05810007f5868737baebc02ee8f2c8428fc
SSDEEP

3072:4J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/W/FnncroP9:8wDeM7iNEkgiOb31k1ECYJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2676-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2676-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34c45a34d9bbd3c7ce3b8c0e64d2068d592c46a3123e10cfc61d73b331ecf9fd.exe

C:\Users\Admin\AppData\Local\Temp\34c45a34d9bbd3c7ce3b8c0e64d2068d592c46a3123e10cfc61d73b331ecf9fd.exe
"C:\Users\Admin\AppData\Local\Temp\34c45a34d9bbd3c7ce3b8c0e64d2068d592c46a3123e10cfc61d73b331ecf9fd.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-MeBSpkSKZSfut2ds.exe

Filesize
236KB

MD5
a8c4c681ae987c563827a3be5d290f14

SHA1
0a43a7710f88623c2a5daa48c076dd4737438715

SHA256
c63825bc92a788eb7a7305a176f0febbf19bdfabc77475c5ecb6726473d1edeb

SHA512
f6669f5c2072839e2ee0848f27306427a85e79534781beb2ec475c8c246c90127973217aee7348b4cbac9bb20fa304febb1ee490ccd522b21b168d6a6c24f802

Download Submit
memory/2676-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2676-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download