44555171be3299da3af0ae524fd66c1a382a9a284b3ce96c480cc53f8efef284

Analysis

max time kernel
110s
max time network
94s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44555171be3299da3af0ae524fd66c1a382a9a284b3ce96c480cc53f8efef284N.exe
Size

83KB
MD5

30720c4939b13bb606223ac79c76cf20
SHA1

283722498e3880dbe3a324bb88dc293401672f3d
SHA256

44555171be3299da3af0ae524fd66c1a382a9a284b3ce96c480cc53f8efef284
SHA512

62e3670f79d6110eae68c5c5373f62e72529294537afe7ca803d11d37824cf3fac0557d6ba097ca0683cad29fff371b5382240c123a49e93a99c0387e2998a72
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2648-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2648-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000c00000001227d-11.dat	upx
behavioral1/memory/2648-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2648-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44555171be3299da3af0ae524fd66c1a382a9a284b3ce96c480cc53f8efef284N.exe

C:\Users\Admin\AppData\Local\Temp\44555171be3299da3af0ae524fd66c1a382a9a284b3ce96c480cc53f8efef284N.exe
"C:\Users\Admin\AppData\Local\Temp\44555171be3299da3af0ae524fd66c1a382a9a284b3ce96c480cc53f8efef284N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-neGtMT2d4K70CDPE.exe

Filesize
83KB

MD5
e96e087655c8e417e020ad67ac625591

SHA1
9aabad7e946996d6a367df60ea0b00466b23142f

SHA256
aa94848ab1f650ea27dab8f45c9f79bc99b0cf1b8ee2c3049df2f2a61a8ba6b4

SHA512
3059af199536c85ada111328e401f60a7e2266d553a530b72231f49a7d647331877baba9ad172e6e28dcd20c58f857f80825a2a9f5594c742ddb064306d052d2

Download Submit
memory/2648-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2648-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2648-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2648-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download