9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41a

Analysis

max time kernel
111s
max time network
96s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe
Size

83KB
MD5

3dd9246129bc6309704b8cccf2078f20
SHA1

6eae05130525f33315e3a41596a0d4e3c7a81af8
SHA256

9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41a
SHA512

42e16512e000e74e93da49b8933f80dee1d67954bc8cc6a24b4d12c9f9db5b341d15bca3dd688e2d55d1df57b99f468526b541a8242c3eb22801e7661555f902
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2140-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2140-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2140-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000e000000012262-11.dat	upx
behavioral1/memory/2140-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2140-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe

C:\Users\Admin\AppData\Local\Temp\9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe
"C:\Users\Admin\AppData\Local\Temp\9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-xlMJhibM1h5ivczG.exe

Filesize
83KB

MD5
9e77c752d95c074e5542588baedea76c

SHA1
b97d056d56f0a859944beda18ce2f43e4800c5d4

SHA256
27ade1aaf28ba631df89ba25723804e2fd7575b59065f65182ef469fc60e1d06

SHA512
68f68d96ad0a1771718e5cbfcbe8286ffafbd1f1bcfb8cdc99a5fb446e0cea99fb61fa666d17cc6277f478604fc131d6bfb8f20f81a55fb7b724e8600f1937af

Download Submit
memory/2140-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2140-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2140-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2140-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2140-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download