de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784

Analysis

max time kernel
91s
max time network
92s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe
Size

236KB
MD5

bfb2a65edcc9e9c8d362cc8be6d9c020
SHA1

20f4bff6dd94ea2632f5aec8a0c218eaaebd93ef
SHA256

de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784
SHA512

f04a67126e778580f37d6ebe043c1464f4aba47ffafb1a3856635f318b05fdd4d9dea88c40c3bf62f566d12354a9ca3333b405f13e7149dbea7b7e844030c0c3
SSDEEP

3072:lJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/e/FnncroP9:vwDeM7iNEkgiOb31k1ECQJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2640-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2640-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x00090000000120fe-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe

C:\Users\Admin\AppData\Local\Temp\de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe
"C:\Users\Admin\AppData\Local\Temp\de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-a1SLc52j7rHyDjF9.exe

Filesize
236KB

MD5
25f2abfdf73d79bef8afb135496dad28

SHA1
3a4be7058ee63ecf0dd8486e7d5dbfd322dcb8ca

SHA256
55c686f4bffeec7af6b588ab4f0e41441888c6c086a64d9492e50a9b1271140e

SHA512
17ef59b47f45fab8eaeb58b7124445d422a7739a93546687422cb27758d544c999603971d31561d19ae168ac2e40e160b54ade1cc9bdee9aac6decd48e9f1238

Download Submit
memory/2640-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2640-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download