fec5771e05e490bf03b74ad457692805fa4707771cbf0b3eae72ed5c2bfc7ab9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b3dc9e5f3e8805236e4b134635e9660N.exe
Size

236KB
MD5

0b3dc9e5f3e8805236e4b134635e9660
SHA1

53933bdf368c8d4a035aa2e5d543f63b1c3c7b4d
SHA256

fec5771e05e490bf03b74ad457692805fa4707771cbf0b3eae72ed5c2bfc7ab9
SHA512

38bda86e88bd90c73d716f033f58ffadda116d6017ac07086d9cd8d2aaa2f0692960b0c20ddf6ddfccaa9382a0dae6ba5ef2785c22ca521046e062a217d21387
SSDEEP

3072:4J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/7/FnncroP9:8wDeM7iNEkgiOb31k1ECbJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/3056-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0009000000012281-6.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b3dc9e5f3e8805236e4b134635e9660N.exe

C:\Users\Admin\AppData\Local\Temp\0b3dc9e5f3e8805236e4b134635e9660N.exe
"C:\Users\Admin\AppData\Local\Temp\0b3dc9e5f3e8805236e4b134635e9660N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-YuJHFmLCXrbQo6YI.exe

Filesize
236KB

MD5
2cced362294e25f5a94d723c38a0a82f

SHA1
f5e69be3bfebef7d69c8d668cf4ee2e894f4a748

SHA256
4d101341e3404a927d7b8ea722ea63e13f94847a42ec796503a57765582e81bc

SHA512
42cf3bf6032ed698e2b0e9b8ed267ab09578030c273f88e95fb2e1050db23e3dc76753551ef7dad03b13ee5c4491c8921a3cf292f4604a80dbb01201f07ac818

Download Submit
memory/3056-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3056-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download