2c9f46ef5d90cf0051847bf459647cf7835abbec952a7d8f064d3e0ba9f03f1b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee90ea11b2ce33ce0ddc203eab22ac40N.exe
Size

83KB
MD5

ee90ea11b2ce33ce0ddc203eab22ac40
SHA1

80e1348a6bdc219165c0fb08f48c7fba7a9660c3
SHA256

2c9f46ef5d90cf0051847bf459647cf7835abbec952a7d8f064d3e0ba9f03f1b
SHA512

d3a2a24baf74a3557130c8ada5bbaa33022dd9c1add944e68afd03031a0980018ac5defef5b9a7a9ea457335591a4fc18c732647a3e78c75edc496a4871087e0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2500-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2500-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2500-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2500-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2500-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee90ea11b2ce33ce0ddc203eab22ac40N.exe

C:\Users\Admin\AppData\Local\Temp\ee90ea11b2ce33ce0ddc203eab22ac40N.exe
"C:\Users\Admin\AppData\Local\Temp\ee90ea11b2ce33ce0ddc203eab22ac40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-9LOiWUbDfadvVQqV.exe

Filesize
83KB

MD5
310fa620a77348dfe6aa841ed3a8c144

SHA1
b06b8210266df66ee7e0e9e6d9b34026e9845c99

SHA256
c5768dd494cbfcf795750acc49b6f3ff4d86c799bb5ab51d1f7112f1983c7a14

SHA512
74324a862dbc64f39904cf32be40fdcb91a1df5b09953c22ceb506adfe068deb50a02cd6e762aff041426b5530bceb670ccce65810ce1c79faddaaa72dbe22e7

Download Submit
memory/2500-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2500-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2500-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2500-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2500-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download