d0557d8db94fd947d21240d21e17d2cf2b4ed95fd6088b4b4893343bd79a5500

Analysis

max time kernel
111s
max time network
97s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0557d8db94fd947d21240d21e17d2cf2b4ed95fd6088b4b4893343bd79a5500N.exe
Size

83KB
MD5

513590988b686dbe27cda195be998000
SHA1

d49eb16105d90dbd9a37877be2c64cb2c76a0524
SHA256

d0557d8db94fd947d21240d21e17d2cf2b4ed95fd6088b4b4893343bd79a5500
SHA512

b9702104beae8a412ded3b5ae4eb9f4c95e0b1606335c6d589951b0aa0169555e607cd8b26e020d8d9650628bc321e837846aae1c5e6180b65c3dbb519664b61
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+oK:LJ0TAz6Mte4A+aaZx8EnCGVuo

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1956-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1956-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1956-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1956-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0008000000018dcf-12.dat	upx
behavioral1/memory/1956-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1956-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0557d8db94fd947d21240d21e17d2cf2b4ed95fd6088b4b4893343bd79a5500N.exe

C:\Users\Admin\AppData\Local\Temp\d0557d8db94fd947d21240d21e17d2cf2b4ed95fd6088b4b4893343bd79a5500N.exe
"C:\Users\Admin\AppData\Local\Temp\d0557d8db94fd947d21240d21e17d2cf2b4ed95fd6088b4b4893343bd79a5500N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-l9RP4gbqNQRIeUwR.exe

Filesize
83KB

MD5
6c6aeb97e0f5ed39b8d877bd6282de46

SHA1
9d98fb32b9bd87c796198037d662f6cc6ac4bcb8

SHA256
fa33a0146f85831ff1a817a24a9d811827bf4d4c27315be6be750be7c3db4824

SHA512
7a189847e98bc13adb1bcba3c1739580021188a492a65fed87cf507e078e925a53427c39cfdf907030c97cda4c8b1bf72b9c4137f4d0d21e25f9d914436b78aa

Download Submit
memory/1956-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1956-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1956-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1956-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1956-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1956-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download