00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020c

Analysis

max time kernel
119s
max time network
93s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe
Size

83KB
MD5

4690367b95bfe60b46b863762404a720
SHA1

2fd794439893d4b4fd2a99f860ba6472b71d01a4
SHA256

00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020c
SHA512

72203418363b95bcdd6e983d46f6384e61ffae2deb8659c4fad3d337c7401f85dd371779450a3a65c38a08f577e194a1641f8be39b393416af47c31b2cfb24ad
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2852-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2852-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-11.dat	upx
behavioral1/memory/2852-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2852-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe

C:\Users\Admin\AppData\Local\Temp\00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe
"C:\Users\Admin\AppData\Local\Temp\00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-LDiNsIpJ8Cl7adLs.exe

Filesize
83KB

MD5
fc4adc3359411d04c18e701d4344d826

SHA1
6525a52de48b7fbaac090366d5667c64e033ff77

SHA256
34182dbdd1015781f16e7a3283a0866ce2eb41b2a6b1690e76fa7386e1361b69

SHA512
ee97671fb409469a136925a657677362c4a0c6314d03582d71a63203c637356431b58afa3e38676c2bb3f03588dfa7527bcaefee80b64c0ca15b634b2b14a45a

Download Submit
memory/2852-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2852-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2852-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2852-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2852-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download