88ba0b40d112ed1b4ba0234ba897c105d27094139009ea419cb9817f0368905a

Analysis

max time kernel
95s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcd427438bb3f8e3973960a3165a6b40N.exe
Size

236KB
MD5

fcd427438bb3f8e3973960a3165a6b40
SHA1

828a8dabbef1e6adf2cd2570e6b59b0314833729
SHA256

88ba0b40d112ed1b4ba0234ba897c105d27094139009ea419cb9817f0368905a
SHA512

9718f18ce3759d43d5b4d414654ad9af650badbc275714f65e7947a9092288343fc2a7a980ec16fd89703ec91f2f848da90f51438e25050146215c5bcfba3d71
SSDEEP

3072:zJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/7/FnncroP9:1wDeM7iNEkgiOb31k1EC7J/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/432-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/432-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x00080000000234e8-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcd427438bb3f8e3973960a3165a6b40N.exe

C:\Users\Admin\AppData\Local\Temp\fcd427438bb3f8e3973960a3165a6b40N.exe
"C:\Users\Admin\AppData\Local\Temp\fcd427438bb3f8e3973960a3165a6b40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-nshaJfScb7eLKHDL.exe

Filesize
236KB

MD5
82b5006fd34850b4ed38634c3d5bc0e5

SHA1
9956ffd6d06022dbcbec6467f5894a5de5df2636

SHA256
8ea0d9d072db139faa994932fd5f7c375d7932e295f532e32705421cfbb0ec5a

SHA512
2a51dafad2244c9d364b31bec872caf6d6630d30257d82b7220f80e115e8d4a028e574e55ff6e42b014e918efe4f0ce17262a2057a5f9eeb7bbcd2c5d326ebcc

Download Submit
memory/432-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/432-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download