83acc3b1e417eb75f24afdea1999c7fbe479befc39e32244c7cd0932f09ca869

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

83acc3b1e417eb75f24afdea1999c7fbe479befc39e32244c7cd0932f09ca869N.exe
Size

83KB
MD5

4cc4b719ee9c138ba907a2abb1cd9540
SHA1

43cb19eb8f69912312528db435054706882b242b
SHA256

83acc3b1e417eb75f24afdea1999c7fbe479befc39e32244c7cd0932f09ca869
SHA512

00d9aa97dd506d10990899e13481aa93f451b2e3519fc98054dd6e30f79e5b02040529383341380cbfbd335f0050b1b9cc6cbab006bab07313622700241c5ae2
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1948-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1948-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1948-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/1948-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1948-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83acc3b1e417eb75f24afdea1999c7fbe479befc39e32244c7cd0932f09ca869N.exe

C:\Users\Admin\AppData\Local\Temp\83acc3b1e417eb75f24afdea1999c7fbe479befc39e32244c7cd0932f09ca869N.exe
"C:\Users\Admin\AppData\Local\Temp\83acc3b1e417eb75f24afdea1999c7fbe479befc39e32244c7cd0932f09ca869N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-VTGOqFW6UmQgG6cw.exe

Filesize
83KB

MD5
903398aa8515c2df74a2f6e91c821112

SHA1
2e7a43f1318f9f141c51f23ae3fce2fd650a92d4

SHA256
dfc3a6500bb3d0a60fa9d9b474f41b484f361e86335816f6f14a98229d53359b

SHA512
74c1a40886ff35733f931e4211223d6e7b278b0766067c197ffbefa94c81deb9e40b0e089d1b5b6f3c137c33a151ec3a84b0fafc2952ffbbf320b4d2c16387da

Download Submit
memory/1948-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1948-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1948-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1948-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1948-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download