2a3b04d0c8d096b43e8e2f9b1c7e7fd96f22cc0547b00007b2ca88fcc01f48f4

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a3b04d0c8d096b43e8e2f9b1c7e7fd96f22cc0547b00007b2ca88fcc01f48f4N.exe
Size

83KB
MD5

2916e339cb30d09c358a9df6e68262a0
SHA1

977d2c5707d60bbc883a55b663cc2d47cebb7ae1
SHA256

2a3b04d0c8d096b43e8e2f9b1c7e7fd96f22cc0547b00007b2ca88fcc01f48f4
SHA512

3d854b85eb25fdc435f3d753e59969dd5de70328f7d0be8cd9a5a113cf7b410c19244d7108092a54ebd523ab0f4ede9906e1b3827fd84e049d119b82acab4617
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2352-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2352-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2352-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2352-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2352-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a3b04d0c8d096b43e8e2f9b1c7e7fd96f22cc0547b00007b2ca88fcc01f48f4N.exe

C:\Users\Admin\AppData\Local\Temp\2a3b04d0c8d096b43e8e2f9b1c7e7fd96f22cc0547b00007b2ca88fcc01f48f4N.exe
"C:\Users\Admin\AppData\Local\Temp\2a3b04d0c8d096b43e8e2f9b1c7e7fd96f22cc0547b00007b2ca88fcc01f48f4N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-WfWQvdFdOQ2Rr3Nl.exe

Filesize
83KB

MD5
d47c9c35ac4ef326dd10d9a4931af48e

SHA1
eda4e639c1c72a5a414280eeec6864422a50b644

SHA256
25b261dddd219cd9dc90b2fb4db2ffd008e52e85b7fd6eca073d389a9bcb54a3

SHA512
3687937fe3eaf75aaab15db7f33895644e1f1aa787d20d680f6ce7db5251fba62918d38254c95c39e484cff1ebbb315403016d891cfaf3afdb24eb8ac694b7af

Download Submit
memory/2352-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2352-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2352-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2352-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2352-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download