261a347bd8d755e80f5f3cd691ac2c70e9213cc3142dfec975d2240daae4c1a4

Analysis

max time kernel
120s
max time network
91s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf7462305850e8a27c65814aeaf33c0N.exe
Size

236KB
MD5

fbf7462305850e8a27c65814aeaf33c0
SHA1

701f3ca641108185480489477573229a4aad70ff
SHA256

261a347bd8d755e80f5f3cd691ac2c70e9213cc3142dfec975d2240daae4c1a4
SHA512

131eab7a199045e66ef2ebfc7abafd005ed9f159e1c80b84291e6139131c129dd534fb5fe8cc7490c7d96cb0db725ce2567f434ef642185744d5909b26986d5a
SSDEEP

3072:LJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/g/FnncroP9:NwDeM7iNEkgiOb31k1ECeJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1792-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1792-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0006000000011c2f-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbf7462305850e8a27c65814aeaf33c0N.exe

C:\Users\Admin\AppData\Local\Temp\fbf7462305850e8a27c65814aeaf33c0N.exe
"C:\Users\Admin\AppData\Local\Temp\fbf7462305850e8a27c65814aeaf33c0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-71nE7jWRHsmAS188.exe

Filesize
236KB

MD5
c7e495653b80cb9ff46d6aa44e6140b7

SHA1
f9e41db2a55ebf76c9e660d4822ddeec390d2164

SHA256
061864521a983766d20813702fa496719799d9e7ab61331f676179237a373736

SHA512
30929d0c1f7159c79c9209988c6081f3d73f295c48e775f69106165012c757ab07cf5adbe987eb1d300903bc968fee771609ee89be4a03789b8bc44a766188df

Download Submit
memory/1792-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1792-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download