b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe
Size

83KB
MD5

11473c6ed83505feaa713fcb85046890
SHA1

9776b4119e1e82691fa82b12e5a15ff3e0d2acc6
SHA256

b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94
SHA512

d473d424acf30931730d8b187163896b39a0e5fa5077d9b079d9a34ff8bdf0a70063db7fdda077e4250eecae12e01878b2ad19607935bc8beb16b727aab57664
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+zK:LJ0TAz6Mte4A+aaZx8EnCGVuz

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2576-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2576-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2576-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2576-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe

C:\Users\Admin\AppData\Local\Temp\b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe
"C:\Users\Admin\AppData\Local\Temp\b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-VfcJUQYEZmnfRaFO.exe

Filesize
83KB

MD5
d263733bc6991e6e0ad0415cbf5354a3

SHA1
9958dbfad0d8c405e7e033e0f35642e45d181bbc

SHA256
597e185bb5e40624380f59e9a9341e96a721227d30f1e711d3f4407c133dd98d

SHA512
a763b6c3385d5be97c8d0d7815e472dc790acb65618646a9459fceac4d430afcf9d68bebb74918df60d15c722ccefa5da339a19ef850a19d0fee695b482ea915

Download Submit
memory/2576-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2576-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2576-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2576-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download