d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4

Analysis

max time kernel
110s
max time network
91s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe
Size

83KB
MD5

73b426dad648f4d3dc2efa1a55adbfe0
SHA1

e450dd08ced2887b7a0b34aef99f616d89254a92
SHA256

d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4
SHA512

5f42e400612904e5301ed8c563d62edb270dd2d7d7ae7e8804ccecfffd09bcb84f5cc44d7d5aa4a8b09c2dea58f97528051e16062c85ff543c6be0032ac0410b
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+RK:LJ0TAz6Mte4A+aaZx8EnCGVuR

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1040-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1040-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1040-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000d000000012243-11.dat	upx
behavioral1/memory/1040-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1040-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe

C:\Users\Admin\AppData\Local\Temp\d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe
"C:\Users\Admin\AppData\Local\Temp\d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-K6P6pZ1jEl2CJuCs.exe

Filesize
83KB

MD5
f4845f952d8c77898cc80455cdb50543

SHA1
a4edb80632f7e040f6a62bba4b9ab5cee86d20f1

SHA256
97bf4bb3807fefc76c67e30cbfbad6aa16ecf429ce5fb47ac9936ca59512a77c

SHA512
37b70905c17696b305d1bf5c38da2d49097429511c2ff2a83f9bb657713da841506c46724b4118a787ca795e9deca43a6c312920a172bb8a7c1d9d5175d86a1e

Download Submit
memory/1040-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1040-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1040-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1040-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1040-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download