2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429b

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe
Size

83KB
MD5

1b3f5398274735e4072970d0c8902c90
SHA1

09a97746a4b92155579e0fb3128abbbe77d147ff
SHA256

2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429b
SHA512

ec871fca2c8af95c91ea3cb9e91b5fcd3faa59d36764b5b39657879b07ce56da6062a6e4f3e0aa3c3ad3234d1f294b628ad27d34083e72ec41c85eea0c99906c
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4484-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4484-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4484-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4484-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00080000000235b0-12.dat	upx
behavioral2/memory/4484-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4484-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe

C:\Users\Admin\AppData\Local\Temp\2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe
"C:\Users\Admin\AppData\Local\Temp\2cc63d1c8b917bd1cb8b7578e396adeaf6026665de721b82ea1df2581847429bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1036,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-QojIhvXdE4bmdAlt.exe

Filesize
83KB

MD5
95d9a8a3008da5d91e484f3cc07210fc

SHA1
fdc46e97c1fcc9f4ae94616688739e6966bcad81

SHA256
4d7513a0d66d554ed9d5d85ea95611993f763a39e1fbff6b0232d8108ff1bde1

SHA512
ae1c8b38d7f1258c7ca977b7f66b61d9cc94c3711aaad27529827ba09dccdfbcdfd4d683c282e2ecb67a2389fc091382153b7cd06bfee742bfe08fff4b1a1686

Download Submit
memory/4484-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4484-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4484-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4484-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4484-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4484-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download