b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94

Analysis

max time kernel
111s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe
Size

83KB
MD5

11473c6ed83505feaa713fcb85046890
SHA1

9776b4119e1e82691fa82b12e5a15ff3e0d2acc6
SHA256

b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94
SHA512

d473d424acf30931730d8b187163896b39a0e5fa5077d9b079d9a34ff8bdf0a70063db7fdda077e4250eecae12e01878b2ad19607935bc8beb16b727aab57664
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+zK:LJ0TAz6Mte4A+aaZx8EnCGVuz

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2628-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2628-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2628-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2628-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000800000002345e-12.dat	upx
behavioral2/memory/2628-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2628-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe

C:\Users\Admin\AppData\Local\Temp\b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe
"C:\Users\Admin\AppData\Local\Temp\b9d43fa9132065f7d9303f9ffffa7c5c5dfd9fcf0cbf80d053ee089441062f94N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-7FMZnmU0D73TIj7r.exe

Filesize
83KB

MD5
6d30560bc0ca5115b80f01c7ccc0897d

SHA1
e965f6e7634ff26cdc174f941985aa1bc1f55a32

SHA256
4441c2b363d47245452ffefe66a2917a2d2e63ec3dda1f71c06f31df029de21e

SHA512
f371c2287ed415b6e9844ca0a992a4dd78a9279616d4b0999cc94131214cc0ea8754f2c840f697badeaf6c114948698a0494853888f56edf7f5567bd2392e51d

Download Submit
memory/2628-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2628-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2628-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2628-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2628-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2628-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download