cf9368d1201f872985d5d418de2de6e7d64fe9997bb3e9a40cc23a05d511a3ca

Analysis

max time kernel
140s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf9368d1201f872985d5d418de2de6e7d64fe9997bb3e9a40cc23a05d511a3ca.exe
Size

83KB
MD5

186225af6bf617b01d92f2fe60332b15
SHA1

4ea47daaadd6be082a076c84a0f93d284618bdaf
SHA256

cf9368d1201f872985d5d418de2de6e7d64fe9997bb3e9a40cc23a05d511a3ca
SHA512

e8b5133c33601aff2aa1dc70efe7b112a3fe14bc73f42f3af892b973b759738b22c12b3e84c28a4ed894464dd21ccaa67d34a3c4abe9a24a3e35a20080a6828f
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+4K:LJ0TAz6Mte4A+aaZx8EnCGVu4

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3164-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3164-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3164-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3164-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00080000000233e0-12.dat	upx
behavioral2/memory/3164-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3164-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3164-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf9368d1201f872985d5d418de2de6e7d64fe9997bb3e9a40cc23a05d511a3ca.exe

C:\Users\Admin\AppData\Local\Temp\cf9368d1201f872985d5d418de2de6e7d64fe9997bb3e9a40cc23a05d511a3ca.exe
"C:\Users\Admin\AppData\Local\Temp\cf9368d1201f872985d5d418de2de6e7d64fe9997bb3e9a40cc23a05d511a3ca.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-se5PePdrWH9QqldF.exe

Filesize
83KB

MD5
841bfb3eb6c14e29992b93b419f76547

SHA1
f197b3a84220363db28145d3983559bb7ba88c8a

SHA256
0aced05ae8abf38b24b24a3beb6f1f5337024e3127c9e0268ea13e005bd28145

SHA512
5dd263f086c1d43f8175094b251be86874ac689c4f4a9e8d48841fbf4a0ecd3ef9d101b9902cc2f3192326ee8e7228ac1808c8dde3e8987a9c095522bdbde41e

Download Submit
memory/3164-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download