f5675e90fd9b3177fd157e712773a65f07adf08d7b442e7654e0a98fa2037fe6

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5675e90fd9b3177fd157e712773a65f07adf08d7b442e7654e0a98fa2037fe6N.exe
Size

83KB
MD5

531a824a2c8d1be4c846ac6f2bb16910
SHA1

4b94fa7b1c0ef8234f95474ebbad62201d5dcb90
SHA256

f5675e90fd9b3177fd157e712773a65f07adf08d7b442e7654e0a98fa2037fe6
SHA512

e953ffa4473612ec2230497c3f650fe422880affc5f97b8a47121580761657508dc9d33ab28a689593fe374caaaf836eabb7382569784912d2eb8a2420f3ece3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2224-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2224-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2224-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2224-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5675e90fd9b3177fd157e712773a65f07adf08d7b442e7654e0a98fa2037fe6N.exe

C:\Users\Admin\AppData\Local\Temp\f5675e90fd9b3177fd157e712773a65f07adf08d7b442e7654e0a98fa2037fe6N.exe
"C:\Users\Admin\AppData\Local\Temp\f5675e90fd9b3177fd157e712773a65f07adf08d7b442e7654e0a98fa2037fe6N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-z11JqoIasPKpIHoZ.exe

Filesize
83KB

MD5
47e4c12c77e23f046246281eb174f90c

SHA1
838b11cc884909d15a209b25a4c11fac8a3d88ef

SHA256
7f528ee1ee2b38707fd5d0ee10aae8d46117094ed59788e39d6584e950c088ee

SHA512
13668c6011878b7e6d52cf780f88678c16a61571434ccf1932e8389e5bf57bbc6a92c4c723d77bad6fc58610d720ac198e4410f3de5fae9bd42cd32af1104e4a

Download Submit
memory/2224-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download