c327042e8b3a99c9b7ae531878ba04aa4d65f685b7f7e89ce12fd2db5e757a4f

Analysis

max time kernel
94s
max time network
92s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c327042e8b3a99c9b7ae531878ba04aa4d65f685b7f7e89ce12fd2db5e757a4fN.exe
Size

236KB
MD5

c31222516ced91e7b53d2337c968b980
SHA1

5e5adde635c8e4f973ad95a5bc2c1363617ad134
SHA256

c327042e8b3a99c9b7ae531878ba04aa4d65f685b7f7e89ce12fd2db5e757a4f
SHA512

b601f22ba73298285b8a99927531afae7a9422ac48cefcf53e3ab23bfb8084f0948d53a7cff62612f6132455ef8c0b5fd4f9acac8fb8b68786a28c43196a5bff
SSDEEP

3072:qJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/I/FnncroP9:+wDeM7iNEkgiOb31k1ECGJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1760-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000c00000001225e-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c327042e8b3a99c9b7ae531878ba04aa4d65f685b7f7e89ce12fd2db5e757a4fN.exe

C:\Users\Admin\AppData\Local\Temp\c327042e8b3a99c9b7ae531878ba04aa4d65f685b7f7e89ce12fd2db5e757a4fN.exe
"C:\Users\Admin\AppData\Local\Temp\c327042e8b3a99c9b7ae531878ba04aa4d65f685b7f7e89ce12fd2db5e757a4fN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-oFz3aEZHbHwMSDLO.exe

Filesize
236KB

MD5
e9a8954567ef69f4d86117845714654f

SHA1
0ad6ee2e40271460a3243b644501328791192195

SHA256
909c6e97c3552df234c5d10f69a7de967fef375d5728bf93ec439a701dd02a86

SHA512
1c414180c6a3888d573e85f2779979b6244a07b21c6deb67245e7f382f649a85639e1fa9271efccefc44d4e01a9b2e5cd120f88079129031c6391f17da97b642

Download Submit
memory/1760-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1760-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download