97643fab5869522f0f078fca6ee76013580c5228bdc46d747529a6226369ca3f

Analysis

max time kernel
111s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97643fab5869522f0f078fca6ee76013580c5228bdc46d747529a6226369ca3fN.exe
Size

83KB
MD5

c41832403e813427a21d191d8a815000
SHA1

9e567de44556633190fa7377dc95ecad2d17034e
SHA256

97643fab5869522f0f078fca6ee76013580c5228bdc46d747529a6226369ca3f
SHA512

f3fffaea3a87e525706995a9b1196c0efeb0e56a685797496325a357a11e9eb35b51f594d19bc28926675c856cc452805233f5795c3f07bb3a73b458f6713109
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+OK:LJ0TAz6Mte4A+aaZx8EnCGVuO

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4436-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4436-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4436-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4436-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00080000000234b2-11.dat	upx
behavioral2/memory/4436-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4436-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97643fab5869522f0f078fca6ee76013580c5228bdc46d747529a6226369ca3fN.exe

C:\Users\Admin\AppData\Local\Temp\97643fab5869522f0f078fca6ee76013580c5228bdc46d747529a6226369ca3fN.exe
"C:\Users\Admin\AppData\Local\Temp\97643fab5869522f0f078fca6ee76013580c5228bdc46d747529a6226369ca3fN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-NUOMERKucQ7UALGh.exe

Filesize
83KB

MD5
a3c55ec2392b0a617f22ffadaee5f5f3

SHA1
edfd56bcacfe36f7df31b721c22a0a7094bfa9e6

SHA256
068c3d16d7686771062cd44c01c648b06db7272a476084954dfa7fe30b669221

SHA512
aa3ae6212bda9f989821be0e784b305c53f2b4b0c6fcbfa2747e29623981199cbe2801502ed49ec7faef3790a774cf21a3b3c1e356e870c17a04b6f7bb88244d

Download Submit
memory/4436-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4436-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4436-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4436-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4436-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4436-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download