770ba9a6679d68a1dce2b98ab68ed6f868e8285a62c657bfea30225186c91749

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

770ba9a6679d68a1dce2b98ab68ed6f868e8285a62c657bfea30225186c91749N.exe
Size

83KB
MD5

e43be4bf493a74abb0a91a5195f20400
SHA1

93af52f94e159ffb60b40b146ee94a0c2d92930b
SHA256

770ba9a6679d68a1dce2b98ab68ed6f868e8285a62c657bfea30225186c91749
SHA512

88bcbf1b88dc218d205cb573e5ec1d37be0146295404addfa355ef88feb506c41cd7b35a5375b6a67ba77737724d5048a2571bb087072251616493e9a8718c96
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:LJ0TAz6Mte4A+aaZx8EnCGVuQ

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2792-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2792-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2792-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2792-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	770ba9a6679d68a1dce2b98ab68ed6f868e8285a62c657bfea30225186c91749N.exe

C:\Users\Admin\AppData\Local\Temp\770ba9a6679d68a1dce2b98ab68ed6f868e8285a62c657bfea30225186c91749N.exe
"C:\Users\Admin\AppData\Local\Temp\770ba9a6679d68a1dce2b98ab68ed6f868e8285a62c657bfea30225186c91749N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Ns7V5eKcLXCoVjrG.exe

Filesize
83KB

MD5
f06984de54de005c09334152e40273ee

SHA1
7e545ebeeecd543412e2febe456644d42276850d

SHA256
6ba1e44ad20fb9e60ebb7e39a25866a28fefc6c356578eb08adfae857869fa5e

SHA512
7a6a8f85bdc353c7da8f0a0bfdd3c41583029059ebc255217c8d388136f5fbabfa5e7e931a72bb53a34e0efa14612a9241d60ad2e11a86535b9764cb97530271

Download Submit
memory/2792-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download