29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe
Size

83KB
MD5

f0c40c685298d85e76fb683ae33d9e70
SHA1

27a4032840383aa913356d014feeaec9ea3b06eb
SHA256

29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8
SHA512

d9b597debd1c39873c417996c397a8d6cdd3561774d30f5c39c9fee8119f0718a5df2379c33be8d26bc35837ff3dd9b6ba15e2001be660441d105dfe7167eafd
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+hK:LJ0TAz6Mte4A+aaZx8EnCGVuh

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4468-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4468-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4468-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4468-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000800000002347f-12.dat	upx
behavioral2/memory/4468-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4468-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe

C:\Users\Admin\AppData\Local\Temp\29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe
"C:\Users\Admin\AppData\Local\Temp\29213ecc81256b4f77941a1e579fdcbd4d95e73e685f55a42c68cafc3dac78c8N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-0LpiyGHw1NFADAs4.exe

Filesize
83KB

MD5
82766fddc137b3a967af160f755ccd4f

SHA1
f7210efbbb00e320aaf3b8452d7884d7063e0e60

SHA256
a1ba83a64b935b568acd00487772c1223f1fc31587f1ad92513edac9d83daec1

SHA512
1e3c67b23661dc92c5c7d3063e69167ea99ab61856daaa82bd4961d9de23de13555a993f5f7d99b769afce2bcd3a772de0bebc0b648ec7823a12ac593403a79e

Download Submit
memory/4468-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4468-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4468-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4468-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4468-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4468-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download