d5f9677caac7856251c2195935b8b3410dc8da298530c8c1e7c25822037fc57b

Analysis

max time kernel
91s
max time network
92s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5f9677caac7856251c2195935b8b3410dc8da298530c8c1e7c25822037fc57bN.exe
Size

236KB
MD5

f0c3f07b5aa7b227b415754ea1860b80
SHA1

b033755fdbf3857bac186effbe296f96d13a1638
SHA256

d5f9677caac7856251c2195935b8b3410dc8da298530c8c1e7c25822037fc57b
SHA512

1b4556853d518127a633a2f696527a98f88b5777fa3d538bff68e3da7d2176dc5dacea8925e28dac43399bf572e7fc6fcdaa556756a78978f684bfd7ca6bb018
SSDEEP

3072:DJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/S/FnncroP9:FwDeM7iNEkgiOb31k1ECUJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1744-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0036000000017530-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5f9677caac7856251c2195935b8b3410dc8da298530c8c1e7c25822037fc57bN.exe

C:\Users\Admin\AppData\Local\Temp\d5f9677caac7856251c2195935b8b3410dc8da298530c8c1e7c25822037fc57bN.exe
"C:\Users\Admin\AppData\Local\Temp\d5f9677caac7856251c2195935b8b3410dc8da298530c8c1e7c25822037fc57bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-8xYxA1zuvKyOGfJQ.exe

Filesize
236KB

MD5
3aca5050a411d4689c4485df2fa52dd5

SHA1
172c852e67e028922285bc6b9d78cf0e5e432cb7

SHA256
00882b2e68cc091d14e8e3ecdb063899894ae06debbdf2b80bd23be5684c287f

SHA512
fc4a8d7a73e433828e31248ce39c60fe394c251627ac4ba1cc48199ba3f698709a3602311815d1625537a7f0c1d09db2d756e7048b8da281fe7de245f70130d3

Download Submit
memory/1744-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1744-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download