a2e523dad66e4ef9667be6d66c36d580d49871fec0a7de028d8962f3b7256a3d

Analysis

max time kernel
92s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce6c1b639df418ef66cde54d960ccf80N.exe
Size

236KB
MD5

ce6c1b639df418ef66cde54d960ccf80
SHA1

eaa166c77b16548418309e348e3681145d901c70
SHA256

a2e523dad66e4ef9667be6d66c36d580d49871fec0a7de028d8962f3b7256a3d
SHA512

b3e26d2f5195a5a4721655d22e0aa03b710e1debeaf407276b95c25ff85c7e6762396002a008585007677cce08ba97507d156be195d27ddb29d3c205e91f1f7d
SSDEEP

3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/w/FnncroP9:wwDeM7iNEkgiOb31k1ECeJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2720-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2720-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce6c1b639df418ef66cde54d960ccf80N.exe

C:\Users\Admin\AppData\Local\Temp\ce6c1b639df418ef66cde54d960ccf80N.exe
"C:\Users\Admin\AppData\Local\Temp\ce6c1b639df418ef66cde54d960ccf80N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-anvR0eC55E8rzxsZ.exe

Filesize
236KB

MD5
ed029b51639d76d4474e127c8885edb7

SHA1
38877375773dad96a6b95fcde7310e985299b4ac

SHA256
b2295b73106fe2e458e86a45e9d604b4aa28176e22ac0aff432db55b67c6e2c0

SHA512
0d2e08bb11245b2997171de937b0ab545c7074ea795a4a6815b44c9f01b323dcfc1e5acedc466fa631a4397e3c1791c2dbcb2a57fd0cd58f1b1bb69e6f559243

Download Submit
memory/2720-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2720-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download