9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41a

Analysis

max time kernel
111s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe
Size

83KB
MD5

3dd9246129bc6309704b8cccf2078f20
SHA1

6eae05130525f33315e3a41596a0d4e3c7a81af8
SHA256

9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41a
SHA512

42e16512e000e74e93da49b8933f80dee1d67954bc8cc6a24b4d12c9f9db5b341d15bca3dd688e2d55d1df57b99f468526b541a8242c3eb22801e7661555f902
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/644-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/644-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/644-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/644-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00080000000234e9-11.dat	upx
behavioral2/memory/644-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/644-19-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe

C:\Users\Admin\AppData\Local\Temp\9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe
"C:\Users\Admin\AppData\Local\Temp\9eb0c21f3ec21ddcfcb9de21f3f208042f648da7525111a2cd4fa28aca6ad41aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Pgb2UqeJHdHI0h9e.exe

Filesize
83KB

MD5
34153e747eed8eeabac32c8b5a797e56

SHA1
1240a1a3ff39fd115077e6d89a1e66c2e4ac2305

SHA256
e3b4c0dc8ca4508c95adfc1edeb5b2752d013b16a552d8ff814eb63f3fb44aa2

SHA512
cf839fc6b087fda78c8e0f826117ebae75dff330d70b5a0063213f70b89a7b65b1db8e67f3cce0dc79af3e3b8319694910b927bc1388334d9bb17246f8329609

Download Submit
memory/644-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/644-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/644-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/644-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/644-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/644-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download