15428a83807c3b14d7c2e4f5f4caed1a22594e8888aef60a0db8017f99c1a10a

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cc8c1545c9e596a5a5ea309df3a4260N.exe
Size

83KB
MD5

6cc8c1545c9e596a5a5ea309df3a4260
SHA1

c0b066cb2b3dfaa05f9deb1c1b4d81388fce9e89
SHA256

15428a83807c3b14d7c2e4f5f4caed1a22594e8888aef60a0db8017f99c1a10a
SHA512

8277b1743fa54327dbdc22297e3d8a0e61cfdb0a377f844b955b302de43dbe32ae44e68d1227610f15022b17bc47399eb2c35c1b9502fb6c2b2fede339c27a22
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+sK:LJ0TAz6Mte4A+aaZx8EnCGVus

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2724-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2724-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2724-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-11.dat	upx
behavioral1/memory/2724-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2724-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cc8c1545c9e596a5a5ea309df3a4260N.exe

C:\Users\Admin\AppData\Local\Temp\6cc8c1545c9e596a5a5ea309df3a4260N.exe
"C:\Users\Admin\AppData\Local\Temp\6cc8c1545c9e596a5a5ea309df3a4260N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-1FL2uSGBanSEB4Ez.exe

Filesize
83KB

MD5
28e3e6461290ecf91fa95cc123449d68

SHA1
e0e1013b08b960ea459db9ba4f75caeb4e0aec6e

SHA256
676aff23ae3c225aa1d08dae696cae8b6a1e365583f87245219c0413e685e0ae

SHA512
14e44c185cb7e24572d9dd87d1d299a959beeebbaef788cc6d8dd0ebfe2cbe1b628b6e977765bcdfacc95fc539506d20504fb3c871da6a4efa3843762e9836a7

Download Submit
memory/2724-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2724-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2724-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2724-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2724-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download