de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784

Analysis

max time kernel
101s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe
Size

236KB
MD5

bfb2a65edcc9e9c8d362cc8be6d9c020
SHA1

20f4bff6dd94ea2632f5aec8a0c218eaaebd93ef
SHA256

de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784
SHA512

f04a67126e778580f37d6ebe043c1464f4aba47ffafb1a3856635f318b05fdd4d9dea88c40c3bf62f566d12354a9ca3333b405f13e7149dbea7b7e844030c0c3
SSDEEP

3072:lJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/e/FnncroP9:vwDeM7iNEkgiOb31k1ECQJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4720-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4720-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000300000001e748-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe

C:\Users\Admin\AppData\Local\Temp\de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe
"C:\Users\Admin\AppData\Local\Temp\de330886a060cc37839b9d07aea1e789d6272877e3322287a93bad7648168784N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-j6eivmzLquOAGhbC.exe

Filesize
236KB

MD5
18e09728dce5f88b893fd22f11f3077b

SHA1
33f9c3da988ae7ef224786e8ab367af9d7b8eae6

SHA256
c7f2c3a0f4be6c2fb34d1f480111c66d2ba7bfd0b8c26727d2275b5611567823

SHA512
8ee45a10bf5c19c6c3ad43d3769f86bcebeb35519ef81d884de0d4c728b12fd7c6d54d08be64cbf6e3f015e77fe4d230747579da4fcc6151cf4335e4e286c53f

Download Submit
memory/4720-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4720-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download