Analysis

  • max time kernel
    111s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 01:15

General

  • Target

    52e204e8428894d51d66f9a490477770N.exe

  • Size

    83KB

  • MD5

    52e204e8428894d51d66f9a490477770

  • SHA1

    d03c2b517da779f76a5b0ed8cd12b0946c7525f7

  • SHA256

    ea05651df9110af94629c4f171c8c6a57bbc87b3b72c2382d7dcbe38b7a3074b

  • SHA512

    1bfc32c201c24ce6c8cbd22a7c1ef5b2bc917093605dfca0783587b9d05b9192d0627eaa8d6441aef15d8af8a839862e01786fe5b6e9d884c1e2327fbc26d156

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+jK:LJ0TAz6Mte4A+aaZx8EnCGVuj

Score
7/10

Malware Config

Signatures

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\52e204e8428894d51d66f9a490477770N.exe
    "C:\Users\Admin\AppData\Local\Temp\52e204e8428894d51d66f9a490477770N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2424

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\rifaien2-59duEstQCBJLJon8.exe

          Filesize

          83KB

          MD5

          c7122f6480db653da8bc6d6b3e2a42d1

          SHA1

          1cca6e209f4f34a23a359c483eab6f04a9890088

          SHA256

          7cd5121fef0ee77bd41d76356d5cf8625d1625f722897739bb4562c9bcc886bc

          SHA512

          09d2f54dc7c05a5f001024b46f04ad80a6b4f44ed6eccb0389af78a75a579df3eaea6cd1a1325888e922e1e608fab0841ff4f43c815afaef284afa5317d7f156

        • memory/2424-0-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/2424-1-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/2424-4-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/2424-8-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/2424-11-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/2424-15-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/2424-21-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB