13728d5e1eb0ffbabfe500b0fa2d4eb2fccbc645cdd1ec870e026f55387be936

Analysis

max time kernel
91s
max time network
96s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e02114bbe84108657f152c3ff64920N.exe
Size

236KB
MD5

60e02114bbe84108657f152c3ff64920
SHA1

7b06d30761dc6ea75723a434a44a98d3b1f38879
SHA256

13728d5e1eb0ffbabfe500b0fa2d4eb2fccbc645cdd1ec870e026f55387be936
SHA512

5da872287c131e0e6f6010ceb41d0ee29a0ae12cd7848cc89d0a63534f270ba4f15252084240aab00f451e923c8b132ddf93dfce7b608d91fab94350cdc60070
SSDEEP

3072:TJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/D/FnncroP9:VwDeM7iNEkgiOb31k1ECjJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2108-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2108-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x001500000000f6b0-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60e02114bbe84108657f152c3ff64920N.exe

C:\Users\Admin\AppData\Local\Temp\60e02114bbe84108657f152c3ff64920N.exe
"C:\Users\Admin\AppData\Local\Temp\60e02114bbe84108657f152c3ff64920N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-0xzBGMamMaXFaW4u.exe

Filesize
236KB

MD5
b3f4b51df436a700a1ff7511e71dcd60

SHA1
1f90b4c258e59ec2862bb3736698d288a366a215

SHA256
c5039ed69b19f46e3c368113c8307cc81db96733c20333dbccf983155e6570a9

SHA512
1e153241815b51da3d555c5fd78b6174be4e0eba35b96a785178c707c027f43a49e5553b983ea3ec5995d417c6e7db523d0f1a967377128a421c20dd87be8c77

Download Submit
memory/2108-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2108-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download