7cd3e161beb9e7e65e244159fc528c7fe4eec97fe5cad8371fce83755f5c3a8b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0852ef0867219dea7905381eef56a960N.exe
Size

236KB
MD5

0852ef0867219dea7905381eef56a960
SHA1

278f14e183d0aa10c7d266b1a8ed4eee66d66c6a
SHA256

7cd3e161beb9e7e65e244159fc528c7fe4eec97fe5cad8371fce83755f5c3a8b
SHA512

81fd81368c6f652f0dba1410f805e282b570b74edd2ebc462a79a5dad19c5af196b1bb69a764885244046b197c2d5ab236cbaf4e3100651defc622f6d4daabb1
SSDEEP

3072:/J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/3/FnncroP9:hwDeM7iNEkgiOb31k1ECXJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1732-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0852ef0867219dea7905381eef56a960N.exe

C:\Users\Admin\AppData\Local\Temp\0852ef0867219dea7905381eef56a960N.exe
"C:\Users\Admin\AppData\Local\Temp\0852ef0867219dea7905381eef56a960N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-DVSfbuBgtZXifytm.exe

Filesize
236KB

MD5
cdda7323eb5deb5965e96db86b738695

SHA1
d3080d831f9d3d106d100b7cd622f5af7e250cb2

SHA256
9d33312ca71d751b8f7a3c92e2f4a89d7a3d83fb7f63753db349087401bf8026

SHA512
4c466c31b07e706a0869ebf1582725e3711c4d450b09cdee93526d4957f6efb2d963c579a6bcdb721f00b2b5eac17f5c29f9f46fb17c39547a51e9996087fe2b

Download Submit
memory/1732-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1732-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download