13f9b667ef39b361a53a023a007ccb633432fff988882524f4eb49258413b0f1

Analysis

max time kernel
111s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d615d45284ce23870724c6e039a1d00N.exe
Size

83KB
MD5

4d615d45284ce23870724c6e039a1d00
SHA1

aa752b32a6ec8841d85f2c6763cbbac7784ad567
SHA256

13f9b667ef39b361a53a023a007ccb633432fff988882524f4eb49258413b0f1
SHA512

9cc0cf342a3fbfcdf1e18f8f0756126d065f1248179926c494e4a8b6c294f074c38da7a80682c8a0192ec53dc1f89145f7994b3f2983e191807a307bd66dc347
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+8K:LJ0TAz6Mte4A+aaZx8EnCGVu8

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1860-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1860-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1860-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1860-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000300000001e6dc-11.dat	upx
behavioral2/memory/1860-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1860-19-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d615d45284ce23870724c6e039a1d00N.exe

C:\Users\Admin\AppData\Local\Temp\4d615d45284ce23870724c6e039a1d00N.exe
"C:\Users\Admin\AppData\Local\Temp\4d615d45284ce23870724c6e039a1d00N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-gYWfH4wYmduLQs0J.exe

Filesize
83KB

MD5
0422814081078038bd38555cb19ff4ab

SHA1
00fdf1179a8892d89bcc2dd1703d8d2050c82bde

SHA256
9418375c7c13cec7f92dba53143bbb31ad46791804719895628f911eacb449d2

SHA512
f8c0989496f68d778e74277f17516b24e70bac6b03d7829370bce71eb07dd0da61402ec6a05c0ec707f1da40417f88e22cc6993656ed6911a007ba068e23b5ec

Download Submit
memory/1860-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1860-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1860-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1860-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1860-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1860-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download