Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 05:19

General

  • Target

    133f8f95dd9d482bca531980b4dcb39fc5832a0673688480d1abfd71dca96d0fN.exe

  • Size

    83KB

  • MD5

    8d38c7e34290e35c4120d99eee24a060

  • SHA1

    8d1a3875847cd5bc616d2a73fa9a4109ed2f671a

  • SHA256

    133f8f95dd9d482bca531980b4dcb39fc5832a0673688480d1abfd71dca96d0f

  • SHA512

    cb235935e551b9021c4e1fda87b156734cdd1ea90b132b66971f0a86acc02dcd0e6a61962a1ab09f8d2e790a2b135d491a455337e9f2999f39f4fd96d4de49a8

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1K:LJ0TAz6Mte4A+aaZx8EnCGVu1

Score
7/10

Malware Config

Signatures

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\133f8f95dd9d482bca531980b4dcb39fc5832a0673688480d1abfd71dca96d0fN.exe
    "C:\Users\Admin\AppData\Local\Temp\133f8f95dd9d482bca531980b4dcb39fc5832a0673688480d1abfd71dca96d0fN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-mRMnQ3DiksxGOwRb.exe

    Filesize

    83KB

    MD5

    ea555dbdc150301e37e0411c5c5ab7b9

    SHA1

    343105976f5c6baf2caf44ee924cc778b3ccac56

    SHA256

    c39b0721c77f729434df8768ea6bd6d3b8e8a7380a381600d649bac3235c202c

    SHA512

    1bb5bb3520f258ef02acdc95c1d4fcd85c82998d76bace76575b508e73d439b095ff740e2b87a946c88abadd285b36e3782301e28f1c7cd8749a8a779e920594

  • memory/4372-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4372-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4372-5-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4372-11-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4372-15-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4372-22-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB