23ca52db51cee39823c9086b24c57971609b8a51f4a7660c23d2074f69646b97

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23ca52db51cee39823c9086b24c57971609b8a51f4a7660c23d2074f69646b97N.exe
Size

236KB
MD5

8f116cfa9235cda1935eae017d9718e0
SHA1

0677747941035d7ebf2649d42bb9a2df2d1f2bba
SHA256

23ca52db51cee39823c9086b24c57971609b8a51f4a7660c23d2074f69646b97
SHA512

566ae745f710d9b1087939bf04a1ab25d4a6411e31371b749d2cf803fd571c22bd99b06ed950da71a99afdfac75b7292707ee7f1d066cdb57307a65bc4d2ec7a
SSDEEP

3072:LJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/2/FnncroP9:NwDeM7iNEkgiOb31k1ECoJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2976-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2976-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x00080000000234b8-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23ca52db51cee39823c9086b24c57971609b8a51f4a7660c23d2074f69646b97N.exe

C:\Users\Admin\AppData\Local\Temp\23ca52db51cee39823c9086b24c57971609b8a51f4a7660c23d2074f69646b97N.exe
"C:\Users\Admin\AppData\Local\Temp\23ca52db51cee39823c9086b24c57971609b8a51f4a7660c23d2074f69646b97N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-HjRvSeq0qzirB3BX.exe

Filesize
236KB

MD5
12db69f8af00b9e034dc4527ac17780a

SHA1
11ba842adaa6df63803918d536911609d92d4959

SHA256
4584c2e4f02218e3fa0d584dc32a6ed8cf34603fb3b5597f422bbd62be51ce03

SHA512
d6c6ee835201d24a08d9ee0debffac2f1ecc53a4a3332a10790cb3408f18f049b9247b67693b685aed7099d9a9ae917ae02173ee7abc0c57df0f816b879353ae

Download Submit
memory/2976-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2976-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download