93a4dd014dcae363f1c2091f2ce1ac00a890e8b3836cc3d688ce7fe46ec2bd36

Analysis

max time kernel
111s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a698ce95324799dd485a9b0ec337c60N.exe
Size

83KB
MD5

6a698ce95324799dd485a9b0ec337c60
SHA1

6613338ae1acc1f0139de9080bf1e5f2155576cb
SHA256

93a4dd014dcae363f1c2091f2ce1ac00a890e8b3836cc3d688ce7fe46ec2bd36
SHA512

921fc6a103f90acfa26af515e1263671d8d6fb40649158cd0bc41256062de2326b9b5c6824913310d3b8fdaf50994c58e2f68795a8a0c9a8c903b9f881db1fc5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2640-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2640-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2640-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2640-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000a000000023423-11.dat	upx
behavioral2/memory/2640-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2640-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a698ce95324799dd485a9b0ec337c60N.exe

C:\Users\Admin\AppData\Local\Temp\6a698ce95324799dd485a9b0ec337c60N.exe
"C:\Users\Admin\AppData\Local\Temp\6a698ce95324799dd485a9b0ec337c60N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-9pBmd2mYQHN15VJa.exe

Filesize
83KB

MD5
6aa77aaf8bc680d2f75e339b92e1e887

SHA1
279b883517d2bf40e2abb901c56cdea86ff882fe

SHA256
4b629cd39fb3924e92e2adc802158b800011b8525b8ea135d5b6f2893f318432

SHA512
8611d847c415f2761f7ce3986bf6975a327e8f7c73dbc0368fc071aa8691b1a9a8427989bd9cc7a35b25351df5663da9465ff640d23c9a96475866269652ba12

Download Submit
memory/2640-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download