00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020c

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe
Size

83KB
MD5

4690367b95bfe60b46b863762404a720
SHA1

2fd794439893d4b4fd2a99f860ba6472b71d01a4
SHA256

00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020c
SHA512

72203418363b95bcdd6e983d46f6384e61ffae2deb8659c4fad3d337c7401f85dd371779450a3a65c38a08f577e194a1641f8be39b393416af47c31b2cfb24ad
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1676-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023443-12.dat	upx
behavioral2/memory/1676-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe

C:\Users\Admin\AppData\Local\Temp\00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe
"C:\Users\Admin\AppData\Local\Temp\00dcd056f431c9b3f47b112ffa41c9feac419480c6eca5d1f7cb455a6fe1020cN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-rgcfOigzNfD9wDNS.exe

Filesize
83KB

MD5
98b28c3a7e8e1d29e2386f672751672d

SHA1
ee223e35e5782c85f04cef4ccd469a6dac6ab6d3

SHA256
ed717732a37b79e3ab138df6b6c6361a16cff75e7370d452f3fb73195ba51eb6

SHA512
12777f4c6da2e769757c13d03094e47de1e5df440233e65dafb54a4297b129aa40b3b5e20c0879c1e702ee304ddb67af4e0588fd6461531d9ec4d52635203795

Download Submit
memory/1676-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download