d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4

Analysis

max time kernel
110s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe
Size

83KB
MD5

73b426dad648f4d3dc2efa1a55adbfe0
SHA1

e450dd08ced2887b7a0b34aef99f616d89254a92
SHA256

d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4
SHA512

5f42e400612904e5301ed8c563d62edb270dd2d7d7ae7e8804ccecfffd09bcb84f5cc44d7d5aa4a8b09c2dea58f97528051e16062c85ff543c6be0032ac0410b
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+RK:LJ0TAz6Mte4A+aaZx8EnCGVuR

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4500-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4500-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4500-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4500-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00080000000233ae-12.dat	upx
behavioral2/memory/4500-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4500-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe

C:\Users\Admin\AppData\Local\Temp\d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe
"C:\Users\Admin\AppData\Local\Temp\d2f0f22632cf621f93358dc03bb5921e2af852f40f63a1ec96fa0a73b82ec5e4N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-xTXd8vQAsHyFtBPc.exe

Filesize
83KB

MD5
a66906c2a5a6b18a12e36f1ae4eee13b

SHA1
a014a1c31dc1c11840b62eb7c136e53c0073a982

SHA256
fca7610d88041ffe7445bc5758fd3d6aa8b5cfdbceb483f2a3de450654b81eeb

SHA512
e7e2484dcf7d425fad5020a3b82fe06653563ff1700869a73ab86b69b0283e61e121bbcf0e6fd6f70f6289e532ca6fa8e15c2a2fa13544cb1f0041fd3d84a71e

Download Submit
memory/4500-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4500-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4500-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4500-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4500-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4500-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download