287d6e9a49f610027354c80c4e0e5f680bcfc6ef857385c6501734cd1cacd7fa

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

287d6e9a49f610027354c80c4e0e5f680bcfc6ef857385c6501734cd1cacd7faN.exe
Size

236KB
MD5

3532cfc86f42803624fbee4c8c9286b0
SHA1

a8712c013dba67ecce432ebe7e7b8708740cae9e
SHA256

287d6e9a49f610027354c80c4e0e5f680bcfc6ef857385c6501734cd1cacd7fa
SHA512

d5e80b423699fd24fe8c8f3a2d963bd417d51fd27a69f77f98e2c5bc16c5e5b8fa0036e139db39614a07301ccb369fb340e160d202ae950cce4cea1e68d003c1
SSDEEP

3072:gJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/FnncroP9:EwDeM7iNEkgiOb31k1ECSJ/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1852-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1852-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	287d6e9a49f610027354c80c4e0e5f680bcfc6ef857385c6501734cd1cacd7faN.exe

C:\Users\Admin\AppData\Local\Temp\287d6e9a49f610027354c80c4e0e5f680bcfc6ef857385c6501734cd1cacd7faN.exe
"C:\Users\Admin\AppData\Local\Temp\287d6e9a49f610027354c80c4e0e5f680bcfc6ef857385c6501734cd1cacd7faN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-VXaAeF99y8k2ttte.exe

Filesize
236KB

MD5
1fc3b8dff1338dce681e3eda6dd55ba7

SHA1
134989f5b113798816f6babaab266706b5ec2c00

SHA256
f653ddc9f19b8600c879d148305192182d3fb2e52f5251a106d01b19901970dc

SHA512
9932bf66002b16236bbb4fa267552e353eb6a41c0c39dbe68d10c86913f25b36ea5e22fdcd56b61834b5024a76a650427ad75f226f7c43400ed47d07c523c243

Download Submit
memory/1852-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download