Analysis

  • max time kernel
    111s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 23:15

General

  • Target

    c44c0a91bdc980085d1dc608c0e271e0N.exe

  • Size

    83KB

  • MD5

    c44c0a91bdc980085d1dc608c0e271e0

  • SHA1

    81ea1219508b2b19a5a31808ea4c3c8594406702

  • SHA256

    2ad7c57d26b4a946249c251951c92be1457d429f5af1a6828cbcdc8dc74dd653

  • SHA512

    bd62e002994d146a8a949083986b421036169aec4c53cc00f6a47848c698cdf89c974ca1b341988950b202e1a4e84cef33686f69b214e06400899e3276dc3ae2

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+5K:LJ0TAz6Mte4A+aaZx8EnCGVu5

Score
7/10

Malware Config

Signatures

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c44c0a91bdc980085d1dc608c0e271e0N.exe
    "C:\Users\Admin\AppData\Local\Temp\c44c0a91bdc980085d1dc608c0e271e0N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-bQuP9BxdhFtnRZqJ.exe

    Filesize

    83KB

    MD5

    c2d3373b9e6375ce68fb0782c8fc5eac

    SHA1

    f57bc100bffdb65768d150df32a11e746abe9ab4

    SHA256

    b13f2713250d4dee734e1423eb7fc54b0f9c578c0e6d36c51e7ba29e3cee7484

    SHA512

    61d871a5224e3a596b43db24b9e2bfbe1a355f39801912f45fcc7d8c8cfcaa5aa9a1b6bc3a1bed59e0b5c5f2ea1762c6a708b636151c325302e9874d2e858ef4

  • memory/1116-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1116-2-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1116-5-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1116-9-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1116-13-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1116-22-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB