768417d4e652c40f8f26a0e4bbae49b19e448ea999a194ea25661d43a38569c6

Analysis

max time kernel
90s
max time network
91s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

258b4b413891b543527233f11b6b6f60N.exe
Size

236KB
MD5

258b4b413891b543527233f11b6b6f60
SHA1

05e722974ced5d0b15e5931140e9fa4f523ae1a5
SHA256

768417d4e652c40f8f26a0e4bbae49b19e448ea999a194ea25661d43a38569c6
SHA512

cea21351bd4372407f656c986b2e561fd2fea16b56dc6733f6c771006246a982ce3cc92d9276f730eaf7dd36b1f100d342522d34b6fe703833022b2a6544e26b
SSDEEP

3072:oJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/S/FnncroP9:swDeM7iNEkgiOb31k1EC0J/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/628-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/628-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x00080000000120fd-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	258b4b413891b543527233f11b6b6f60N.exe

C:\Users\Admin\AppData\Local\Temp\258b4b413891b543527233f11b6b6f60N.exe
"C:\Users\Admin\AppData\Local\Temp\258b4b413891b543527233f11b6b6f60N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-tOFjKOH3SrrWWmuM.exe

Filesize
236KB

MD5
3222c00a03376f52d8b3b1bea0460fe8

SHA1
51199b65e8e184d9ffd51fb9823ca79002dfd7a9

SHA256
537f33689b2b867aafa7cdeaa81fd9180d2af4407b89183b306f29b0a34b2f26

SHA512
0d6689d675b163cd8ea73e329493b17d7da4c863013e710420f59ba4c8784d4305782a49572ec1f435806bca3a39d127ea276c7a492a0e7a0577e842fb90c3c9

Download Submit
memory/628-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/628-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download