30656df21a91cd600eb106b3609bb506c2f285bb185a16ad476fd0e0cb646aa0

Analysis

max time kernel
111s
max time network
99s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d826417c637ee7259f0bb0ba2ca2870N.exe
Size

83KB
MD5

5d826417c637ee7259f0bb0ba2ca2870
SHA1

a787b9a3767f1b7e6c640f9fd84c8c9ba4a6df48
SHA256

30656df21a91cd600eb106b3609bb506c2f285bb185a16ad476fd0e0cb646aa0
SHA512

3aaf2fc3d40784b5f9b3c215fc0c0eaa9f1c48f35bc3ad1e29a21bf3156facd61d60e0cd64c9a5a0e085d4abedbade2efc8a4bf92d360ab66c72eb31cf5c8f36
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3064-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3064-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3064-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000d000000012250-11.dat	upx
behavioral1/memory/3064-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3064-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d826417c637ee7259f0bb0ba2ca2870N.exe

C:\Users\Admin\AppData\Local\Temp\5d826417c637ee7259f0bb0ba2ca2870N.exe
"C:\Users\Admin\AppData\Local\Temp\5d826417c637ee7259f0bb0ba2ca2870N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-E72I9IJFgH3RycFD.exe

Filesize
83KB

MD5
dab8b56304703461a426af267ed1bd18

SHA1
99ffb97164bf69f7209536f92b9764b87b595931

SHA256
c3cdcd2f7757b98ca297f68cc5e6ca485bad305843b19ce6c3f34ebd1f80bb0c

SHA512
11b1cdeb09c2136e0d7c8d1bd9325917461ba9ae5b1bc0895c6eac8ef03021cf537c530d272e0a845c9a6e6fb74d3c11af63eb01f122dbc1aa8795521cc5b1cc

Download Submit
memory/3064-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3064-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3064-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3064-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3064-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download