a1d3ba93c401d4e885bf1df17f163caae9b373d023f324823f27f51e2e316d76

Analysis

max time kernel
90s
max time network
94s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c93166f1966dc91ce05e5e69eb703d90N.exe
Size

236KB
MD5

c93166f1966dc91ce05e5e69eb703d90
SHA1

e753d434380bd7bbe547f98f1e0ce8bde5d2a830
SHA256

a1d3ba93c401d4e885bf1df17f163caae9b373d023f324823f27f51e2e316d76
SHA512

3ce56869e0c07762254e958fbe526e1ea3cf1f78a51d30431e4f600a6d98c3582d7de5fc93cfbd0a48fdde30919c99f58da89740280b66c2e95cb46db0779ea9
SSDEEP

3072:VJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/FnncroP9:fwDeM7iNEkgiOb31k1ECJJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2264-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000c00000001225e-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c93166f1966dc91ce05e5e69eb703d90N.exe

C:\Users\Admin\AppData\Local\Temp\c93166f1966dc91ce05e5e69eb703d90N.exe
"C:\Users\Admin\AppData\Local\Temp\c93166f1966dc91ce05e5e69eb703d90N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-FDELAksouLS9m99w.exe

Filesize
236KB

MD5
82ae093047ba8cb306958dd1ea316100

SHA1
7ec42a5ce511de0a6c3bd6ea48754ce610f569b7

SHA256
92855b37af444e704bf0c4bcd2a500d7339d91af7418ef627532dedce7ce9b02

SHA512
e3b5c5892b94ed57ef87ea264981b301a2a00710112238ee0275bcf5aaef186d9f21299c08ca92ee6d66f878ba6078b277fe50bd6b99d7124149ac59fc00a16e

Download Submit
memory/2264-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2264-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download