aee320e92f3b24c616713992cefd3140ac7660e6b1a6d42d59cf6c8eff9c3b8c

Analysis

max time kernel
111s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe2df97f411013335f0868b0ac87dfa0N.exe
Size

83KB
MD5

fe2df97f411013335f0868b0ac87dfa0
SHA1

fe10a46e0c11243eed726e4d3a7fc652dfa14d7d
SHA256

aee320e92f3b24c616713992cefd3140ac7660e6b1a6d42d59cf6c8eff9c3b8c
SHA512

eebb79d012355fee9fc38651850b427d297071c7cdd6fd882413b75c08d5b2ac5fc878d64a53d4f4575c1c6952c84e777924f1cbcac5088603776c2b5fffe0c1
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+yK:LJ0TAz6Mte4A+aaZx8EnCGVuy

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4120-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4120-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4120-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4120-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4120-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000800000002344d-12.dat	upx
behavioral2/memory/4120-20-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe2df97f411013335f0868b0ac87dfa0N.exe

C:\Users\Admin\AppData\Local\Temp\fe2df97f411013335f0868b0ac87dfa0N.exe
"C:\Users\Admin\AppData\Local\Temp\fe2df97f411013335f0868b0ac87dfa0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-q14fZsxXyCGb7KIS.exe

Filesize
83KB

MD5
1e2c0fb4695086c995c20a31b35cb24b

SHA1
0edcbfcd10efeec40e871358dbbf871988646157

SHA256
111b556de608c2e80491c58fcf5a8ad5a70fd461efc4d88343e7f256f14f09df

SHA512
c6ecd71d38f27de774d250005abb527319311e6dad023cba8e61625039639a0e3789113a67cefa6fc5cea843d5fd987131eb3c5b8938bc25c1dd4bba8e8ce918

Download Submit
memory/4120-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4120-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4120-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4120-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4120-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4120-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download