665e6d53479e23f2e4d3f7e3037a4486a61019d07a6c168bbe8f8006cea4a9af

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

665e6d53479e23f2e4d3f7e3037a4486a61019d07a6c168bbe8f8006cea4a9afN.exe
Size

83KB
MD5

2bd4bdf285d4afa96a721e81773abc50
SHA1

19e57c6add81a2f84079eae1899a79f6af5fc9fb
SHA256

665e6d53479e23f2e4d3f7e3037a4486a61019d07a6c168bbe8f8006cea4a9af
SHA512

08a570b44c53f1e3d5cba73c39959b68b8c711d5238e681346eb126d2db32d8dbeab36341585664945bbb63e3bc3fb383a797fde21ff299c002a7bc0f4e11287
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+BK:LJ0TAz6Mte4A+aaZx8EnCGVuB

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2684-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2684-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2684-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2684-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	665e6d53479e23f2e4d3f7e3037a4486a61019d07a6c168bbe8f8006cea4a9afN.exe

C:\Users\Admin\AppData\Local\Temp\665e6d53479e23f2e4d3f7e3037a4486a61019d07a6c168bbe8f8006cea4a9afN.exe
"C:\Users\Admin\AppData\Local\Temp\665e6d53479e23f2e4d3f7e3037a4486a61019d07a6c168bbe8f8006cea4a9afN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-jtI0K0f8wuBasjaL.exe

Filesize
83KB

MD5
679a5be77aea1ff97882d774dc6fa4b1

SHA1
0987b403de1f80103afbc6a43f86da82ea632066

SHA256
e7e4718fa80d5d9ed9adcfed78d17190f515fed281991dce43cb34ae74099451

SHA512
0a71b66ee5dbef1915a69b21d85083c76689322162de71db7f8b7a5fd759c342bcebea404eda0130620bd83a7cfe785813733403b4a54b5fbd6358eb1dd2e4de

Download Submit
memory/2684-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2684-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2684-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2684-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download