2c9f46ef5d90cf0051847bf459647cf7835abbec952a7d8f064d3e0ba9f03f1b

Analysis

max time kernel
111s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee90ea11b2ce33ce0ddc203eab22ac40N.exe
Size

83KB
MD5

ee90ea11b2ce33ce0ddc203eab22ac40
SHA1

80e1348a6bdc219165c0fb08f48c7fba7a9660c3
SHA256

2c9f46ef5d90cf0051847bf459647cf7835abbec952a7d8f064d3e0ba9f03f1b
SHA512

d3a2a24baf74a3557130c8ada5bbaa33022dd9c1add944e68afd03031a0980018ac5defef5b9a7a9ea457335591a4fc18c732647a3e78c75edc496a4871087e0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2704-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2704-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2704-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2704-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00080000000234d5-12.dat	upx
behavioral2/memory/2704-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2704-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee90ea11b2ce33ce0ddc203eab22ac40N.exe

C:\Users\Admin\AppData\Local\Temp\ee90ea11b2ce33ce0ddc203eab22ac40N.exe
"C:\Users\Admin\AppData\Local\Temp\ee90ea11b2ce33ce0ddc203eab22ac40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-pePJ2atmDMBCRqbf.exe

Filesize
83KB

MD5
aabf53727ae2fe347cdb1533a7879915

SHA1
449160bce38375210162c029db6911a592f37f05

SHA256
acdb4d3f08d7e402033ed3bd479562cdab3e34fa4a2638e0fd7ce65a57e2f67c

SHA512
9453316172dbc82c8f60c31dfb9f8b908eb04893f0bf04ed7c1c42b11feb99d7f5aaa0daf287df2949d616cfec62ba367c3617ecd9a4ce55c28de701a662da73

Download Submit
memory/2704-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download