52d425990c6b74accb8ba86e55559684c42e3c0a6966fb223da0b5b9877956e3

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52d425990c6b74accb8ba86e55559684c42e3c0a6966fb223da0b5b9877956e3N.exe
Size

83KB
MD5

1508361423eb19aaa770f26ef35896c0
SHA1

b010934281a80b2c497ad05d03bd05f4aa9a9e5f
SHA256

52d425990c6b74accb8ba86e55559684c42e3c0a6966fb223da0b5b9877956e3
SHA512

1eb214b2b6497fb59314d878c841eeb2598a1deca75a1858c477be36574f8038e75c020d8b663674d3cc88dd2fb7b9a0736f86dcb69f7baab82ff77a8806170a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2188-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2188-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2188-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2188-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52d425990c6b74accb8ba86e55559684c42e3c0a6966fb223da0b5b9877956e3N.exe

C:\Users\Admin\AppData\Local\Temp\52d425990c6b74accb8ba86e55559684c42e3c0a6966fb223da0b5b9877956e3N.exe
"C:\Users\Admin\AppData\Local\Temp\52d425990c6b74accb8ba86e55559684c42e3c0a6966fb223da0b5b9877956e3N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Pql3rQPzn2gC4pjf.exe

Filesize
83KB

MD5
56363664624ea3389b470d445142eb59

SHA1
54aa02dd7c26845e93f307551c114ff6488bdc01

SHA256
28d8367fb86301befd8d611307743e3733dc4b0bb128f1af0b40cb2b8e69c25d

SHA512
e905e7429d63f535ad58322cb049b70a9dfc22f61cb1c4cc8dac11fc21723a27880000b59d295b3851c597c6e8adcc039c332ab4796c58dd7ee73f99dccea6ff

Download Submit
memory/2188-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download