f1976dd16bf83bada96413f083aa993838544100577436fe63aeb1f0740b20fc

Analysis

max time kernel
110s
max time network
96s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1976dd16bf83bada96413f083aa993838544100577436fe63aeb1f0740b20fcN.exe
Size

83KB
MD5

0a70b4e5b2da744733bf17db0af9f7b0
SHA1

cdbddb8aa6027977e7a55f9936237f2c0fca8645
SHA256

f1976dd16bf83bada96413f083aa993838544100577436fe63aeb1f0740b20fc
SHA512

9c793184eb036dfdc071863646d59054e9b16e8320d7bc8181319b3861c1800ad0563e3d02389a549f8b6acb62144f1a98d3d72bd8e5f257bb8d98e97691a1e7
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2308-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2308-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x00090000000120fe-12.dat	upx
behavioral1/memory/2308-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2308-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1976dd16bf83bada96413f083aa993838544100577436fe63aeb1f0740b20fcN.exe

C:\Users\Admin\AppData\Local\Temp\f1976dd16bf83bada96413f083aa993838544100577436fe63aeb1f0740b20fcN.exe
"C:\Users\Admin\AppData\Local\Temp\f1976dd16bf83bada96413f083aa993838544100577436fe63aeb1f0740b20fcN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-jfjUaIfzDkSNmQ8z.exe

Filesize
83KB

MD5
39bf2ab3eadce1717f3d2a2242d5e6b2

SHA1
60b1621ed9c59ec38217474c6fe5dc68de05aee1

SHA256
9ae48562462e937f9f188a18d1e886c9d28753053d3aeb796f2c49413c8b9b42

SHA512
2e29881920f5acf4a80a8da4c635d56710a661f449be7e4449f992b645da13a1d749ca9b88ea3d7407dfff92f9499de1dd335dc588236fa98937f25cdf1194ff

Download Submit
memory/2308-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2308-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2308-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2308-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2308-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download