00305bf7e8d8c6194f89fa96018e13b574baee8d5a139ecd8e250e5ac9aa8b89

Analysis

max time kernel
111s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe
Size

83KB
MD5

555d6fec1bc3eb1f6f2b57fbbbfe2a40
SHA1

c70ba99309c08cb871d7ae7a81456abdc15ab652
SHA256

00305bf7e8d8c6194f89fa96018e13b574baee8d5a139ecd8e250e5ac9aa8b89
SHA512

eab7877bc36ef5de6965c25e4876a909b661cf0ff165d96e68bd80cc9ddad9d67948ce58ab7318980a745537d9890c31e075aab39465246c2b3cd9998ee685c5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:LJ0TAz6Mte4A+aaZx8EnCGVuW

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/808-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/808-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/808-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/808-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000900000002339d-11.dat	upx
behavioral2/memory/808-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/808-20-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe

C:\Users\Admin\AppData\Local\Temp\555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe
"C:\Users\Admin\AppData\Local\Temp\555d6fec1bc3eb1f6f2b57fbbbfe2a40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-LF5Nt5WKZdIQyGH7.exe

Filesize
83KB

MD5
5f1e02f9d1d34e74c68f255784222922

SHA1
8936dabdf5e1ecc0bf6c35c22d570c926703ed76

SHA256
cf6e764b5692cff329e5b8b1d57bb8b4f29eea6efaf243f0a250a380a5bac3a9

SHA512
cb95a7d872b1892abc14cccd10e1fd3026381fbd443442b2379566a838319e8eb8d38be38c9d7898bd667d89bebda18f18dbbe0875748cc79a57a07b6d4a47d7

Download Submit
memory/808-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/808-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/808-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/808-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/808-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/808-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download