94e8cf2f80a76a7f8f633259ba6c9d945f64d8233d083e0582b3f9089f0cb551

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94e8cf2f80a76a7f8f633259ba6c9d945f64d8233d083e0582b3f9089f0cb551N.exe
Size

83KB
MD5

4b55023f6705ff0d07db11cd7a3d4160
SHA1

ec42bef7beac2b0b22e25f22d57d5aaf2080624c
SHA256

94e8cf2f80a76a7f8f633259ba6c9d945f64d8233d083e0582b3f9089f0cb551
SHA512

38e110d8c26c2d3d6968eac4ce1c64851136532eeac9a25612c07fc612bc0824a3169b3e7b898a4737ffe3659f6a62e417548b76fc7c857ccf3b19e611a2145e
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+fK:LJ0TAz6Mte4A+aaZx8EnCGVuf

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4600-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4600-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4600-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4600-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4600-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000200000001e44c-11.dat	upx
behavioral2/memory/4600-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94e8cf2f80a76a7f8f633259ba6c9d945f64d8233d083e0582b3f9089f0cb551N.exe

C:\Users\Admin\AppData\Local\Temp\94e8cf2f80a76a7f8f633259ba6c9d945f64d8233d083e0582b3f9089f0cb551N.exe
"C:\Users\Admin\AppData\Local\Temp\94e8cf2f80a76a7f8f633259ba6c9d945f64d8233d083e0582b3f9089f0cb551N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-HOYUAGRiGZ5cvr9H.exe

Filesize
83KB

MD5
7673ae68df3feed79b1a0f5ad4d62db8

SHA1
3635939c997530b79c23e3030d1279ab7045e41f

SHA256
8dbeddcee22f3d1ebaa979aff8934bc261c2991ed58db4895c45c180c1f7f6ca

SHA512
26e0d74a2fc2f22330adfa35e39f02232cc85d97f5f343ff8ea93abcf288b7869aca3b694ffe387baca509e1c2c91c5f9782376436a1034cef901a0fd6e7d758

Download Submit
memory/4600-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4600-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4600-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4600-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4600-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4600-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download