80d55cd24979c59fdfaf5c05648a27c74b50ad9373f0a61450f005c71debdc59

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80d55cd24979c59fdfaf5c05648a27c74b50ad9373f0a61450f005c71debdc59N.exe
Size

83KB
MD5

5b29129f78bd1926edfae104fe6ba2a0
SHA1

b9c850e885d5575655af30d8935983501317f23d
SHA256

80d55cd24979c59fdfaf5c05648a27c74b50ad9373f0a61450f005c71debdc59
SHA512

e9e357b395b5205f037fc7ffc9f04d43001a075a9a654c7bbfc29484d2f3a14085942a9b00092fc5470fee0ffdbe24fd5493a66074ae2aeabac0d72867972217
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:LJ0TAz6Mte4A+aaZx8EnCGVuQ

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2624-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2624-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000a0000000120f9-11.dat	upx
behavioral1/memory/2624-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2624-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80d55cd24979c59fdfaf5c05648a27c74b50ad9373f0a61450f005c71debdc59N.exe

C:\Users\Admin\AppData\Local\Temp\80d55cd24979c59fdfaf5c05648a27c74b50ad9373f0a61450f005c71debdc59N.exe
"C:\Users\Admin\AppData\Local\Temp\80d55cd24979c59fdfaf5c05648a27c74b50ad9373f0a61450f005c71debdc59N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-lzLrjFzeUkehnCT9.exe

Filesize
83KB

MD5
6ffa68245d03c78597b9d1ebce69fd37

SHA1
90391aaf25f1b110a2474ae8157f9b104d6fda53

SHA256
b469800edbcf78212b70248242c25542994a826fdd785567400fefe13e1e1257

SHA512
04bb7c9f1ec9434e14c8451e4a9a275f5375eb6491aa3bde45b96e7b078b31f6bf3db5e7538e55352fb4ca6b9f6ed9eb4c080a0d184d89c290f37e4e41c5b4d8

Download Submit
memory/2624-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2624-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2624-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2624-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2624-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download