29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe
Size

83KB
MD5

f0c40c685298d85e76fb683ae33d9e70
SHA1

27a4032840383aa913356d014feeaec9ea3b06eb
SHA256

29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8
SHA512

d9b597debd1c39873c417996c397a8d6cdd3561774d30f5c39c9fee8119f0718a5df2379c33be8d26bc35837ff3dd9b6ba15e2001be660441d105dfe7167eafd
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+hK:LJ0TAz6Mte4A+aaZx8EnCGVuh

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2544-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2544-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2544-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2544-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2544-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe

C:\Users\Admin\AppData\Local\Temp\29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe
"C:\Users\Admin\AppData\Local\Temp\29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-SKGOuAzTH6keY39W.exe

Filesize
83KB

MD5
e1abf6eb1d56ac77ad4649f000cfc8d7

SHA1
18d32f29dcf4ded4bf853bf6e9f3bb353f4f8264

SHA256
45d1f669ea47c91a6242e9565d12b3788ae2aaf67def26aa8af7d1c35e5e358a

SHA512
feefae08224b66981c4baad6ba16cbf897c76ebee20d17c674d6a2e7a0d2ca8e29970eb6c66d05204628ed2062f62114062406f4955c50b37a6c349f3be7f339

Download Submit
memory/2544-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2544-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2544-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2544-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2544-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download