00305bf7e8d8c6194f89fa96018e13b574baee8d5a139ecd8e250e5ac9aa8b89

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe
Size

83KB
MD5

555d6fec1bc3eb1f6f2b57fbbbfe2a40
SHA1

c70ba99309c08cb871d7ae7a81456abdc15ab652
SHA256

00305bf7e8d8c6194f89fa96018e13b574baee8d5a139ecd8e250e5ac9aa8b89
SHA512

eab7877bc36ef5de6965c25e4876a909b661cf0ff165d96e68bd80cc9ddad9d67948ce58ab7318980a745537d9890c31e075aab39465246c2b3cd9998ee685c5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:LJ0TAz6Mte4A+aaZx8EnCGVuW

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2636-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2636-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2636-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000011ba2-11.dat	upx
behavioral1/memory/2636-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2636-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe

C:\Users\Admin\AppData\Local\Temp\555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe
"C:\Users\Admin\AppData\Local\Temp\555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-PgatvJb866bcCoku.exe

Filesize
83KB

MD5
923fe8e15b0573668d536b16c1ba5126

SHA1
a2a85292ebf22b7b18849340d68808045c05582c

SHA256
0a2f857611556ad1e3a93b44dbca1d8e6ff34a9b1a6751717e54bb840d38c2ac

SHA512
8c2370f59354702c7f325af0b6d9d665a8b39519871188d2569de734ee7dc6fa56e72d4e6d389244751c2f272e72da51e1c0a98e8eee3cc239b22a3d0a513e48

Download Submit
memory/2636-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2636-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2636-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2636-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2636-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download