7cd3e161beb9e7e65e244159fc528c7fe4eec97fe5cad8371fce83755f5c3a8b

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0852ef0867219dea7905381eef56a960N.exe
Size

236KB
MD5

0852ef0867219dea7905381eef56a960
SHA1

278f14e183d0aa10c7d266b1a8ed4eee66d66c6a
SHA256

7cd3e161beb9e7e65e244159fc528c7fe4eec97fe5cad8371fce83755f5c3a8b
SHA512

81fd81368c6f652f0dba1410f805e282b570b74edd2ebc462a79a5dad19c5af196b1bb69a764885244046b197c2d5ab236cbaf4e3100651defc622f6d4daabb1
SSDEEP

3072:/J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/3/FnncroP9:hwDeM7iNEkgiOb31k1ECXJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4880-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4880-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000800000002348d-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0852ef0867219dea7905381eef56a960N.exe

C:\Users\Admin\AppData\Local\Temp\0852ef0867219dea7905381eef56a960N.exe
"C:\Users\Admin\AppData\Local\Temp\0852ef0867219dea7905381eef56a960N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-T9EWnnoXDwkLUgyS.exe

Filesize
236KB

MD5
5589d051004bfcf23a8d5a4879134545

SHA1
3cc784e37138ede56eff27d32484a24c175d9a84

SHA256
766a16badcc4a7306896f9338b93e30e0cad424966a5c58ebd352e72adb16677

SHA512
5264f3f971de85174d896216ead7e1f2f131dd9db9d3366cdf65f26ee6ef8ca335bf4ea5ae68c7d5e8e5c5991b37125f436e0263b9133a1bee95c277ad078839

Download Submit
memory/4880-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4880-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download