b2650b52bdd4709b31062a60a94dfbabed4418a5d63823ac6eee32635ebd52b6

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4f8695d7fbe1177500dfd6bf7380c90N.exe
Size

83KB
MD5

a4f8695d7fbe1177500dfd6bf7380c90
SHA1

905ab5520dc7056b93d588164e6f6480be007d21
SHA256

b2650b52bdd4709b31062a60a94dfbabed4418a5d63823ac6eee32635ebd52b6
SHA512

ddbddf318bca9dd430378e451fa3d88e2b7d0883cb8b3a1adffa76596b1320a16ac1da7afff9238c45ff7680d0cfcf43a8b78a575de7e1317faa50897f27354d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+FK:LJ0TAz6Mte4A+aaZx8EnCGVuF

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3068-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3068-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3068-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3068-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-13.dat	upx
behavioral1/memory/3068-16-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3068-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4f8695d7fbe1177500dfd6bf7380c90N.exe

C:\Users\Admin\AppData\Local\Temp\a4f8695d7fbe1177500dfd6bf7380c90N.exe
"C:\Users\Admin\AppData\Local\Temp\a4f8695d7fbe1177500dfd6bf7380c90N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-g3ZB8GGXBQfXObUj.exe

Filesize
83KB

MD5
7a8600440ec25ff9b72b5b2cf2f5f547

SHA1
f53afdaf3b916dd29540a55fe6483b8be0c90acc

SHA256
ec1429cad0de03f91823a7b2a40aac942cea871b80e522dbc2619489c32ab35f

SHA512
4914fb83a19b16d5ee88f7b206739d9b73e764b5addb43f5158ecc3d332780d73765bca8c61a8ade1663d9cb68d3a2c71b4911e31d2fd40309ac19362bb2c191

Download Submit
memory/3068-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3068-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3068-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3068-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3068-16-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3068-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download