9c225eab71134c7f23fe3443ed8a66334c2dc7f2b91cfbaf401b466d10ccecc9

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c225eab71134c7f23fe3443ed8a66334c2dc7f2b91cfbaf401b466d10ccecc9N.exe
Size

83KB
MD5

caa4b9749e9b932201705443504f1850
SHA1

fca04d91d255a2eb68d4b337833e4d1efe4d155f
SHA256

9c225eab71134c7f23fe3443ed8a66334c2dc7f2b91cfbaf401b466d10ccecc9
SHA512

55eada4bc1b801a7aef88c8bb3b433bfdff47089ca9ff3bc587bbfb595b19c6f177b2922c2adc1f5ff3b353a44f8d2c046dd9c8e85a875258c125f865be7caf6
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+yK:LJ0TAz6Mte4A+aaZx8EnCGVuy

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2408-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2408-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2408-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2408-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2408-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c225eab71134c7f23fe3443ed8a66334c2dc7f2b91cfbaf401b466d10ccecc9N.exe

C:\Users\Admin\AppData\Local\Temp\9c225eab71134c7f23fe3443ed8a66334c2dc7f2b91cfbaf401b466d10ccecc9N.exe
"C:\Users\Admin\AppData\Local\Temp\9c225eab71134c7f23fe3443ed8a66334c2dc7f2b91cfbaf401b466d10ccecc9N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-TvJwjuzhmQGrFBGX.exe

Filesize
83KB

MD5
e36f446a2231b6de2d255db1568658a8

SHA1
ca9e0cd922d5f04b532ed4561b23b99a65df594c

SHA256
2ac19e4f414051e5d2bcf7c92808fef8be6534e9e776498b91f20ee89332b4ad

SHA512
42d3a65db9adf2737b62a7297e65e2b6fc61da41e9f72bc2067f7bb9e0db491bcad83e49490f18411388d888b2cfb830823973ddd147b86c03e31b94becbee82

Download Submit
memory/2408-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2408-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2408-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2408-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2408-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download