c195b6ad6ca0b73e3e61db6d39000c727514c43ecb7bc0c6218704bee3a59c0b

Analysis

max time kernel
90s
max time network
95s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a6d4cba093337ae63e91bb0680bbb7d0N.exe
Size

236KB
MD5

a6d4cba093337ae63e91bb0680bbb7d0
SHA1

d0a533e74443478407c67c3428d5af4aac5a487f
SHA256

c195b6ad6ca0b73e3e61db6d39000c727514c43ecb7bc0c6218704bee3a59c0b
SHA512

ab80f03016b1aa928530cd5780346a13cc1d0d111073d1fc59f6fca391a58bd482a7fd45ee9e231072be69d37fd77d5a98acd935c17b9479c022fdd747580c5b
SSDEEP

3072:nJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/4/FnncroP9:JwDeM7iNEkgiOb31k1ECGJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2432-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2432-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000017801-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6d4cba093337ae63e91bb0680bbb7d0N.exe

C:\Users\Admin\AppData\Local\Temp\a6d4cba093337ae63e91bb0680bbb7d0N.exe
"C:\Users\Admin\AppData\Local\Temp\a6d4cba093337ae63e91bb0680bbb7d0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-yrJH1tlVfVtplHTf.exe

Filesize
236KB

MD5
5b66761808feafe2c090b9cbc1e173b2

SHA1
d178f40e3510a45c5587409a420dc5c7dcd09de7

SHA256
7dcbca6db65c8aa56433b4da496ab0b8f5f00bfdd5e7f62fb096b2d891f2e270

SHA512
b6dc05b2a5602bf6b13891f379e427d07e1839925aa965bf2c18b0e7688eb1a4b77808f29b754026f6ff1bcc7006dcfa7b4c4936b5208148cd57f8b0b608b00b

Download Submit
memory/2432-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2432-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download