8a379ae0e771a7ae445fb2c137a7d9f89fca7298ce544a2dda898f462ebc9fe6

Analysis

max time kernel
94s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a379ae0e771a7ae445fb2c137a7d9f89fca7298ce544a2dda898f462ebc9fe6N.exe
Size

236KB
MD5

ace4f6985e60acae0d1e1f5ad44f03d0
SHA1

f3d3cbd62d6de06d4a5143e512a43b7f08937403
SHA256

8a379ae0e771a7ae445fb2c137a7d9f89fca7298ce544a2dda898f462ebc9fe6
SHA512

7487025f6323acca37eec55a7bae12bbd0d402edfc7c6a171ac9d7eede2899dea9404bb9ed9f02417220adafd13dd4db655dbcca5f67fc754ac829d6c4a7ed62
SSDEEP

3072:eJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/6/FnncroP9:iwDeM7iNEkgiOb31k1EC8J/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3516-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3516-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0008000000023444-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a379ae0e771a7ae445fb2c137a7d9f89fca7298ce544a2dda898f462ebc9fe6N.exe

C:\Users\Admin\AppData\Local\Temp\8a379ae0e771a7ae445fb2c137a7d9f89fca7298ce544a2dda898f462ebc9fe6N.exe
"C:\Users\Admin\AppData\Local\Temp\8a379ae0e771a7ae445fb2c137a7d9f89fca7298ce544a2dda898f462ebc9fe6N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-TP2uAiAJr98tlRP4.exe

Filesize
236KB

MD5
05aa619d45b00b6a508e4cbceef63a52

SHA1
e3f419dd587e87bd55508f33ffee1e061fb7f208

SHA256
fbb925972de7f01087a34b2d3084c24ac2bbbc9d6cb23d5b4d95f407b4170e90

SHA512
88686f5ad1abd1c66d4f9de1e07179736091f326ebb4c23e582c94f154dacdb4e31e37da2773d1db93299447a31f40274d03c93396136bab85356ed25dd27e47

Download Submit
memory/3516-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3516-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download