565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe
Size

8.6MB
MD5

fc11111203356be912c61adf1e966505
SHA1

de9138aa2c5e5afc7da9452a2c50895ca005980d
SHA256

565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7
SHA512

00c978688aa6f0a275c8c52963de8d755746cfab6f7d0916c0d41cee92048221a10fe7942a247e309f995cbbf96fe7772bdd0898723a5e85de2a7b6619bb062c
SSDEEP

196608:oLSyhfJrmbYE2aUTsi8EhbeEtUKCzFrsPhKSa8IcZwYRURRjzcCE5430JP6:o+y/ibJ2DT18EhCE25rsPhxazkwYYRED

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5020	565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5020-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5020-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5020	565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe
5020	565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5020	565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe
5020	565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe
5020	565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe

C:\Users\Admin\AppData\Local\Temp\565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe
"C:\Users\Admin\AppData\Local\Temp\565a21d7e05352e30cd8e20fca48d69a891e841e2e031cf31ae08e8f416fa5f7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HPSocket4C.dll

Filesize
2.1MB

MD5
04869ada712c189caba4822be0e81ea5

SHA1
9c45486b30e6d3ccf0737c5766796baaf58232ab

SHA256
23078015adb0cf53ebf632a895a1a224b3718174e6c2887e1bbb2d28be5e2b8b

SHA512
16f98af15583c60da0cb947ea2230f759bfa27f86ef93ef5f7ffe2adcec6c5f115f52ffa74bae6cf8add94bb6a380fa276f391619256be7a45c53bb7421fdd9c

Download Submit
memory/5020-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-71-0x0000000000400000-0x0000000001699000-memory.dmp

Filesize
18.6MB

Download
memory/5020-5-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/5020-4-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/5020-3-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/5020-2-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/5020-10-0x0000000000400000-0x0000000001699000-memory.dmp

Filesize
18.6MB

Download
memory/5020-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-0-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/5020-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-70-0x0000000000400000-0x0000000001699000-memory.dmp

Filesize
18.6MB

Download
memory/5020-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-1-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/5020-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-7-0x0000000000998000-0x0000000000DFD000-memory.dmp

Filesize
4.4MB

Download
memory/5020-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5020-72-0x0000000000400000-0x0000000001699000-memory.dmp

Filesize
18.6MB

Download
memory/5020-73-0x0000000000400000-0x0000000001699000-memory.dmp

Filesize
18.6MB

Download
memory/5020-74-0x0000000000998000-0x0000000000DFD000-memory.dmp

Filesize
4.4MB

Download
memory/5020-75-0x0000000000400000-0x0000000001699000-memory.dmp

Filesize
18.6MB

Download