423c6c4eecc3717b8890f3cab35e6ec59abe050008afe8790173cdcb748bc3ef

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

423c6c4eecc3717b8890f3cab35e6ec59abe050008afe8790173cdcb748bc3efN.exe
Size

83KB
MD5

18a302c6c6ccde6e207ed6e0f9f6b150
SHA1

176a273b113c5fe4363929d44a19c288b7b8a8a8
SHA256

423c6c4eecc3717b8890f3cab35e6ec59abe050008afe8790173cdcb748bc3ef
SHA512

8ad085830979ec737002ddf675e49ded0c0e1806c012a30c54c7cef84f3216c2170386618c9ee80d170fdf09448bb37e864124dbab099b92fc9aba8ea9c9e50e
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bK:LJ0TAz6Mte4A+aaZx8EnCGVub

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4912-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4912-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4912-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4912-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023436-12.dat	upx
behavioral2/memory/4912-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4912-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	423c6c4eecc3717b8890f3cab35e6ec59abe050008afe8790173cdcb748bc3efN.exe

C:\Users\Admin\AppData\Local\Temp\423c6c4eecc3717b8890f3cab35e6ec59abe050008afe8790173cdcb748bc3efN.exe
"C:\Users\Admin\AppData\Local\Temp\423c6c4eecc3717b8890f3cab35e6ec59abe050008afe8790173cdcb748bc3efN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-1P7wTFPmAwGRFGPT.exe

Filesize
83KB

MD5
53c196c3a29707dcbf9beb6c04a0b966

SHA1
f96b3a6f9cff79b468d758bdbd07426c4961089c

SHA256
8f518dcb08287a651bec40cfcc3da0792b264c09824a4dca9ebc061cb9a09c86

SHA512
c43a53185a8a00f2a0343fecd4fbd1c55a2457ac6c93bdc533fa8f261cb8e277e6a3a8c5ea6fcfd0d2d0eed6ccae858dd73a65d99e460f928d3cd29d80a70c63

Download Submit
memory/4912-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4912-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4912-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4912-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4912-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4912-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download