5434d72a6fe87a2f33071e4645c45944bee597482cdf835a5807fbc6cfaa3a08

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

660bcd82ca087b10a3c2a11236348e60N.exe
Size

236KB
MD5

660bcd82ca087b10a3c2a11236348e60
SHA1

229a25564f83cc65dc308d3702790250496cc640
SHA256

5434d72a6fe87a2f33071e4645c45944bee597482cdf835a5807fbc6cfaa3a08
SHA512

ab4842b276fda079a9b9577bf1b1ce245c4f4bd5044a5c1f98796e1dfea177c31447741f6d006fe08cb9794184d3de8ca71c0eb050b769e23c459b88fa335022
SSDEEP

3072:xJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/a/FnncroP9:7wDeM7iNEkgiOb31k1ECsJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1668-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	660bcd82ca087b10a3c2a11236348e60N.exe

C:\Users\Admin\AppData\Local\Temp\660bcd82ca087b10a3c2a11236348e60N.exe
"C:\Users\Admin\AppData\Local\Temp\660bcd82ca087b10a3c2a11236348e60N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-jCeaZHX9yXj2thGH.exe

Filesize
236KB

MD5
196542e5c7d8213bc1f42a3a171629db

SHA1
3bb7d8d682f70453ce1b106a20ea395592e66f83

SHA256
bcb33816ec86885f8dff4a566add29124992efa6df0e0517fd25dfc0cf058e2b

SHA512
259effe8532af9fae9ffb24acbc58e52f1677522896ffa9d60d12abc3a17c4917110e35e16273cc4aece5de580bc577d93346795ae08c894e3a92040a3a3b5ee

Download Submit
memory/1668-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1668-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download