66f00503d94f6db68443ac3e67e1e9b7d6cf8575470c28dbf6cb44c5ae31abd0

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66f00503d94f6db68443ac3e67e1e9b7d6cf8575470c28dbf6cb44c5ae31abd0N.exe
Size

83KB
MD5

021a42860eb90e3f22f9f3a86eae7a40
SHA1

4f5a705bf493d61e273d21bb45f4519f78964686
SHA256

66f00503d94f6db68443ac3e67e1e9b7d6cf8575470c28dbf6cb44c5ae31abd0
SHA512

22770eed14ed411f22540cf0cbcc93a5c7128c3012ada012b8a5de9dd49c2fea257c2f9f10b0db0db8253ccf5f5af91896562aee9a146ea21d12fdac7474981d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+GK:LJ0TAz6Mte4A+aaZx8EnCGVuG

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1960-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1960-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1960-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1960-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1960-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66f00503d94f6db68443ac3e67e1e9b7d6cf8575470c28dbf6cb44c5ae31abd0N.exe

C:\Users\Admin\AppData\Local\Temp\66f00503d94f6db68443ac3e67e1e9b7d6cf8575470c28dbf6cb44c5ae31abd0N.exe
"C:\Users\Admin\AppData\Local\Temp\66f00503d94f6db68443ac3e67e1e9b7d6cf8575470c28dbf6cb44c5ae31abd0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-c2GyzYG9EKjFc7OC.exe

Filesize
83KB

MD5
e08f04024f0564219554ac6e67845095

SHA1
5ed2fc8dc35d934fca47eed26cc89cede0d1236a

SHA256
c0550e9cbf7893ddbe57efd37ddfdcbba49bc40ea74312c2ae45a62f2af43ec4

SHA512
9fb799a8e63e24263ebceacd51e7d834e74aed04bea0f5be19b7c85e8d95981284f4c822641bf982cc9bdc30eca1f0ab96ca32197637b885c8193da464ce28f3

Download Submit
memory/1960-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1960-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1960-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1960-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1960-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download