476dea849bd59162977d18d21c9179ac3dd5514aaf832effd3bbe3304127812a

Analysis

max time kernel
110s
max time network
94s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

476dea849bd59162977d18d21c9179ac3dd5514aaf832effd3bbe3304127812aN.exe
Size

83KB
MD5

b86be1b0dd25598cb4886fdad3cf7d50
SHA1

889fd221e516f85204b95326f6eec067c43e8511
SHA256

476dea849bd59162977d18d21c9179ac3dd5514aaf832effd3bbe3304127812a
SHA512

51844a26adb9a55b1b78a13ddb0028c35a55feab2c56f6812cb1dd1fc9586b166d8a9a8318c6499cb105fb989dc6d4ec9a596dfc373dfe165bc528c704316d2d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+3K:LJ0TAz6Mte4A+aaZx8EnCGVu3

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2692-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2692-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x00090000000120cd-12.dat	upx
behavioral1/memory/2692-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2692-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	476dea849bd59162977d18d21c9179ac3dd5514aaf832effd3bbe3304127812aN.exe

C:\Users\Admin\AppData\Local\Temp\476dea849bd59162977d18d21c9179ac3dd5514aaf832effd3bbe3304127812aN.exe
"C:\Users\Admin\AppData\Local\Temp\476dea849bd59162977d18d21c9179ac3dd5514aaf832effd3bbe3304127812aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-TjbQvHRy6P8Yqapo.exe

Filesize
83KB

MD5
44606f1188d59758d40158c4afb46eab

SHA1
f0afb7bff102b551c7cec2fe0ce0528c9dcbc897

SHA256
831e940338b14596c8ef69af054b279586b441eabf22dd49bed4d3ccc9da2646

SHA512
614d22dfda418a95848e48ef299a99cdbdfe7f94276d6c7c74460194c22f36972745ed50bd04a7b847a4d052bcd38ffbc1f81ee1ef5f33aa5079b5d488c0201c

Download Submit
memory/2692-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2692-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2692-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2692-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2692-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download