2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429b

Analysis

max time kernel
110s
max time network
91s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe
Size

83KB
MD5

1b3f5398274735e4072970d0c8902c90
SHA1

09a97746a4b92155579e0fb3128abbbe77d147ff
SHA256

2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429b
SHA512

ec871fca2c8af95c91ea3cb9e91b5fcd3faa59d36764b5b39657879b07ce56da6062a6e4f3e0aa3c3ad3234d1f294b628ad27d34083e72ec41c85eea0c99906c
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3056-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3056-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/3056-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3056-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe

C:\Users\Admin\AppData\Local\Temp\2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe
"C:\Users\Admin\AppData\Local\Temp\2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-YsIOKqex3bgwyrOC.exe

Filesize
83KB

MD5
cdfdbe85af328c840e74ebb81a8b0616

SHA1
f0ff9c638ee0888cbd13f830f344007a6f5902ed

SHA256
ebd784ad8bfff379c9d808d0f5ff04778ac535776f456fa7370cf8eb9ab1e4fa

SHA512
5ae32f27bf80719e83fbcbaf3a924b3570c49a74896e33b59767e171edb6539199b3b308486853f024dd8e03864e8e1289fd83293134546aea06a9bbdb64f100

Download Submit
memory/3056-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download