13728d5e1eb0ffbabfe500b0fa2d4eb2fccbc645cdd1ec870e026f55387be936

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e02114bbe84108657f152c3ff64920N.exe
Size

236KB
MD5

60e02114bbe84108657f152c3ff64920
SHA1

7b06d30761dc6ea75723a434a44a98d3b1f38879
SHA256

13728d5e1eb0ffbabfe500b0fa2d4eb2fccbc645cdd1ec870e026f55387be936
SHA512

5da872287c131e0e6f6010ceb41d0ee29a0ae12cd7848cc89d0a63534f270ba4f15252084240aab00f451e923c8b132ddf93dfce7b608d91fab94350cdc60070
SSDEEP

3072:TJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/D/FnncroP9:VwDeM7iNEkgiOb31k1ECjJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1692-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1692-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0008000000023467-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60e02114bbe84108657f152c3ff64920N.exe

C:\Users\Admin\AppData\Local\Temp\60e02114bbe84108657f152c3ff64920N.exe
"C:\Users\Admin\AppData\Local\Temp\60e02114bbe84108657f152c3ff64920N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-WB4KTpXhNGlG7D5a.exe

Filesize
236KB

MD5
38fa0ccc716d60faf03a945bd78863a7

SHA1
2ae5b84efc97246fa760f72257d2680d54ddd08f

SHA256
ba28c978050f14ccc53fbb2a688496d1e990a26ee780744e7997963123f4bb2d

SHA512
3db7744dab03eaf3e6a5c625cb83eb088914b182b85b2068045106ed26fa7552318cf05020d6796d91240d401aa677cc4a843010c12e08edf697146307a26572

Download Submit
memory/1692-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1692-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download