a49c644a0f78ffa0a8a7d01dafddb99d9f00a5f3244016a97a3db29d77d8c20a

Analysis

max time kernel
111s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a49c644a0f78ffa0a8a7d01dafddb99d9f00a5f3244016a97a3db29d77d8c20aN.exe
Size

83KB
MD5

f3a0e5a1587a5d06ecc29404627539a0
SHA1

f4e381715d95d37123e7624a65e3dc88eaf97e6b
SHA256

a49c644a0f78ffa0a8a7d01dafddb99d9f00a5f3244016a97a3db29d77d8c20a
SHA512

160f374b8d76b71fdbbb549d1774eea5b47aad06299d7744e00686c4849313d0f43ddbaeb59e7d1c0b69dc508ca2a16c68575e9f6c662a1bf32113b57e86d988
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1300-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1300-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1300-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1300-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023483-12.dat	upx
behavioral2/memory/1300-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1300-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a49c644a0f78ffa0a8a7d01dafddb99d9f00a5f3244016a97a3db29d77d8c20aN.exe

C:\Users\Admin\AppData\Local\Temp\a49c644a0f78ffa0a8a7d01dafddb99d9f00a5f3244016a97a3db29d77d8c20aN.exe
"C:\Users\Admin\AppData\Local\Temp\a49c644a0f78ffa0a8a7d01dafddb99d9f00a5f3244016a97a3db29d77d8c20aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-dfxOgfIAcugj5ePN.exe

Filesize
83KB

MD5
112adffe5cf61ada858a20522278f1c9

SHA1
2230cfc635424b299b521b827174983d960f5ddd

SHA256
d87c781f5e3cd7ba4cb1ffdcfc13e787b0f5f9909245f65b5d0b371df1271be8

SHA512
897d54a046187c4612d37d7d7686d689ee4f530ce2b48b144b41272c16d98bc79973b9b4ee4338d31c7945ac194abb162582b91f635e38faa4d941fa50a9cb62

Download Submit
memory/1300-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1300-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1300-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1300-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1300-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1300-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download