abf7c50eb9ee73fa35be43f5f31433117a75157d26e9355a2864eda029bc5ae7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

392b3fe651525b38d9e90c781d074760N.exe
Size

236KB
MD5

392b3fe651525b38d9e90c781d074760
SHA1

c665e633ec5c5a20b0b9503bd7491cb70a120c57
SHA256

abf7c50eb9ee73fa35be43f5f31433117a75157d26e9355a2864eda029bc5ae7
SHA512

e9339261072cb068f8d6f22bec1c7b9fefc26a9824e826d9388704a3551a06a61d787353f9d778c0b1423c10c2215faad0a92e523a177ab2fb86277ae9883115
SSDEEP

3072:vJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/e/FnncroP9:RwDeM7iNEkgiOb31k1ECAJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1724-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	392b3fe651525b38d9e90c781d074760N.exe

C:\Users\Admin\AppData\Local\Temp\392b3fe651525b38d9e90c781d074760N.exe
"C:\Users\Admin\AppData\Local\Temp\392b3fe651525b38d9e90c781d074760N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-L8x1sGDBJ3bjZ1qn.exe

Filesize
236KB

MD5
2ce24394fa33ba505f653be482d1fd5b

SHA1
dfb7d12caf5278aca700b91290809997d2e23920

SHA256
a21b621bdf0d5fd761b1edc6d516225e283b6c298e78e6b584cddcfc2983e0f0

SHA512
08fdbfdf7613ff836c13e80a14b1ae7d34d50c76fff0b4f176f9c9ebc714e1fca27d600eec9b9448e5d2f49c962f99885f1f655682324e70601517db4ba717e2

Download Submit
memory/1724-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1724-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download