93a4dd014dcae363f1c2091f2ce1ac00a890e8b3836cc3d688ce7fe46ec2bd36

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a698ce95324799dd485a9b0ec337c60N.exe
Size

83KB
MD5

6a698ce95324799dd485a9b0ec337c60
SHA1

6613338ae1acc1f0139de9080bf1e5f2155576cb
SHA256

93a4dd014dcae363f1c2091f2ce1ac00a890e8b3836cc3d688ce7fe46ec2bd36
SHA512

921fc6a103f90acfa26af515e1263671d8d6fb40649158cd0bc41256062de2326b9b5c6824913310d3b8fdaf50994c58e2f68795a8a0c9a8c903b9f881db1fc5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1092-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1092-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1092-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000a000000012119-11.dat	upx
behavioral1/memory/1092-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1092-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a698ce95324799dd485a9b0ec337c60N.exe

C:\Users\Admin\AppData\Local\Temp\6a698ce95324799dd485a9b0ec337c60N.exe
"C:\Users\Admin\AppData\Local\Temp\6a698ce95324799dd485a9b0ec337c60N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-PN7kbyKv09qwxmv1.exe

Filesize
83KB

MD5
676fdce31d7ee031689c21379c4e41d3

SHA1
272a12d09f6c9664db1c42988ed76f4fd4d843ef

SHA256
cfe4a67f50bffe5be1a0235dc515d523e13a3a9c96e178109478f0cba03b6df9

SHA512
1c94907d7967feed71ecc071f6a93cfd07098c5e701390b2ab3218409d2f05f6103e800e960de6b0f442f6fcbe4da12610608815da471d484fa1fd09ad296e1d

Download Submit
memory/1092-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1092-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1092-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1092-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1092-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download