4a6d6f6c07521949bf1bfbf7fc9684563fd2cdfa7d41ae9dc8fde7a4f6bc50f6

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a6d6f6c07521949bf1bfbf7fc9684563fd2cdfa7d41ae9dc8fde7a4f6bc50f6N.exe
Size

236KB
MD5

ad9d405fe20db02a38da63c057b466e0
SHA1

3189e743fb8f5882774251878cb13ecd41e632c5
SHA256

4a6d6f6c07521949bf1bfbf7fc9684563fd2cdfa7d41ae9dc8fde7a4f6bc50f6
SHA512

622ebba6cf409e860b53815febd50a0e8621cbefcbc482400f5f45fac3876ea0376851c2474126096ea7a64f16a1b4ed9760ba46cdf4c76e3fba30bb07f20612
SSDEEP

3072:RJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/3/FnncroP9:bwDeM7iNEkgiOb31k1ECXJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2012-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2012-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x00080000000234e9-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a6d6f6c07521949bf1bfbf7fc9684563fd2cdfa7d41ae9dc8fde7a4f6bc50f6N.exe

C:\Users\Admin\AppData\Local\Temp\4a6d6f6c07521949bf1bfbf7fc9684563fd2cdfa7d41ae9dc8fde7a4f6bc50f6N.exe
"C:\Users\Admin\AppData\Local\Temp\4a6d6f6c07521949bf1bfbf7fc9684563fd2cdfa7d41ae9dc8fde7a4f6bc50f6N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-KBbuHpSAyaCa6O7Y.exe

Filesize
236KB

MD5
208116c84030ca0bd158b58e577222da

SHA1
2a38d4c48d48c0fe50da36b301d73b82abbb4a58

SHA256
ce311760cca4491e656af1157388c2ebd76ec88880182b47f482cb16dd965d26

SHA512
6fff2f51ff0cdb96ff8b2d4f5495ee66d01d88517292126249f852f332f902499a40bc8bb033bfceedc309ab1c8d0034ed4b2b5108ad9b5f1b9f13e5c49d14fb

Download Submit
memory/2012-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2012-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download