6249944b8a49a12d3d8bc04e1a15ec4ade42056279ae2a2a8a65be9334b260bb

Analysis

max time kernel
96s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6249944b8a49a12d3d8bc04e1a15ec4ade42056279ae2a2a8a65be9334b260bbN.exe
Size

236KB
MD5

d7e3ab63743a3fa0e400d0362b212460
SHA1

436260261253a9030c4123d7c17a41b7c10ce02c
SHA256

6249944b8a49a12d3d8bc04e1a15ec4ade42056279ae2a2a8a65be9334b260bb
SHA512

849e4172576f66f20a3651860cec3c594bbaf0148e58f04cbfb98b0c8340f11814cfa0c6f73c87793241e1bb3b83763de3870d1622bf83b04868643d001f3e3a
SSDEEP

3072:4J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/u/FnncroP9:8wDeM7iNEkgiOb31k1ECwJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3292-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3292-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x00080000000234e9-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6249944b8a49a12d3d8bc04e1a15ec4ade42056279ae2a2a8a65be9334b260bbN.exe

C:\Users\Admin\AppData\Local\Temp\6249944b8a49a12d3d8bc04e1a15ec4ade42056279ae2a2a8a65be9334b260bbN.exe
"C:\Users\Admin\AppData\Local\Temp\6249944b8a49a12d3d8bc04e1a15ec4ade42056279ae2a2a8a65be9334b260bbN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-cYRK7XlLSBom8xFi.exe

Filesize
236KB

MD5
583a0517d668dc47e9258fa86a8aafa8

SHA1
2b745c6d5bbd65478c36b84213d494f045079eda

SHA256
879ea4b658187850ff94d2308cf60e6f2f85f56dd2610c418fe425c86977a031

SHA512
2ab53a5e0bb36f282135fd114caa1895a2cf172ccddd02ce2f1fb8ff858add157a19f55fa6e3d1063767028cb87623a71ed96cd32ae6d84b5e07cdbc382aae91

Download Submit
memory/3292-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3292-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download