85620d14767c95be4c7369cdaeca8aa9d68c696d2e3b555dd2ab40f4691f14bc

Analysis

max time kernel
111s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85620d14767c95be4c7369cdaeca8aa9d68c696d2e3b555dd2ab40f4691f14bcN.exe
Size

83KB
MD5

a525e6b63097fdee2af117b754a25b30
SHA1

1b02010dbe17e313347bc487b3802302ec178b80
SHA256

85620d14767c95be4c7369cdaeca8aa9d68c696d2e3b555dd2ab40f4691f14bc
SHA512

2b8b845ceb19384af547559a5ae11bfd642dfbdab57458b987c697316bb573e9f376321f2a03d316a29e5ceb47dd9181dfb111e9454c0e768fa47077b23cbe4d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+UK:LJ0TAz6Mte4A+aaZx8EnCGVuU

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4828-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4828-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4828-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4828-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023469-11.dat	upx
behavioral2/memory/4828-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4828-20-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85620d14767c95be4c7369cdaeca8aa9d68c696d2e3b555dd2ab40f4691f14bcN.exe

C:\Users\Admin\AppData\Local\Temp\85620d14767c95be4c7369cdaeca8aa9d68c696d2e3b555dd2ab40f4691f14bcN.exe
"C:\Users\Admin\AppData\Local\Temp\85620d14767c95be4c7369cdaeca8aa9d68c696d2e3b555dd2ab40f4691f14bcN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-R0etLo53piYgBySq.exe

Filesize
83KB

MD5
3f6332451d6d9cfefc2a632b099f8dbe

SHA1
cd6799a32ab19fc6dc5bcb8ec15dc8fbcf01d36a

SHA256
12c787f6ff251b026d3c96988a7fcf4e63aa3c5b2cea052c7ab2f40526e23b9b

SHA512
08ed1a5a32bce48e0ee4fb74998f903d16fdd5118a296f443ecc1a6d3c1379c635ef13d1d334a4e32b11bd8cb0c5fcf3df3a8b7103164b557b147b23c24822a5

Download Submit
memory/4828-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4828-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4828-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4828-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4828-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4828-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download