c6f88722cffc62d09dcf09f830c4fed11e9c8e3beaee5de2ac908dd9af585b86

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eaf0568fe74d6d23a06a394d73472bf0N.exe
Size

168KB
MD5

eaf0568fe74d6d23a06a394d73472bf0
SHA1

92cd5def7d69d9bf67e9cad8b2a18b8a5f0d043c
SHA256

c6f88722cffc62d09dcf09f830c4fed11e9c8e3beaee5de2ac908dd9af585b86
SHA512

0b3842a9c4318f4664daab0ccfc10ebf013aace1effd2da26e779c156bfddb225103a6886cce7af2b01c5e9e0aeb5911ae23571108ffb22dc8854c249c0dea57
SSDEEP

3072:fny1GQ4hQ4A41ZthsMsMxFUy4ipiIUV5wzPzhx3:KcQ+Q6ZthsMsMxFQJIUfyzr3

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4744-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4744-1-0x0000000000400000-0x000000000040B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaf0568fe74d6d23a06a394d73472bf0N.exe

C:\Users\Admin\AppData\Local\Temp\eaf0568fe74d6d23a06a394d73472bf0N.exe
"C:\Users\Admin\AppData\Local\Temp\eaf0568fe74d6d23a06a394d73472bf0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4744-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4744-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download