02f83ea26e4618dd89fc1cc8e56818b4e123534cd7028efccda4ed1d31b3b2cc

Analysis

max time kernel
111s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f83ea26e4618dd89fc1cc8e56818b4e123534cd7028efccda4ed1d31b3b2ccN.exe
Size

83KB
MD5

b5233e995b09367a6140e2a36cd66150
SHA1

ebbf4e428a672687c0cc4e556d5488a13d6995ab
SHA256

02f83ea26e4618dd89fc1cc8e56818b4e123534cd7028efccda4ed1d31b3b2cc
SHA512

f9d2f84dbfbbf163a4c551b58dd9b4e1a9c842e9e4ec12b8c2000c75c22d8b443d6b0c8c646cd00167e7935b8b63d83cd71223d413bf62c20da5aca3f405c7f0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+sK:LJ0TAz6Mte4A+aaZx8EnCGVus

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4404-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4404-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4404-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4404-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023448-11.dat	upx
behavioral2/memory/4404-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4404-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f83ea26e4618dd89fc1cc8e56818b4e123534cd7028efccda4ed1d31b3b2ccN.exe

C:\Users\Admin\AppData\Local\Temp\02f83ea26e4618dd89fc1cc8e56818b4e123534cd7028efccda4ed1d31b3b2ccN.exe
"C:\Users\Admin\AppData\Local\Temp\02f83ea26e4618dd89fc1cc8e56818b4e123534cd7028efccda4ed1d31b3b2ccN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-gYUEpquA7j5yEsxA.exe

Filesize
83KB

MD5
5eec009811aaf49c1466082ac52e1ba1

SHA1
ff397fe794d591b585dc862a91dcab66e84b3a8a

SHA256
cc1be60a8732bde530ebaea363f0071d26b06216afa53817b6a191b84b28a10b

SHA512
02b637c11a357f5dd9e6cfa00ce4f262140d983d0abb0d9f1a40da4567c6b530c498b6a5d986d514fc2ec09c6bd9b6f22fa282736ab2750fab2179c6fdbe9831

Download Submit
memory/4404-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4404-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4404-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4404-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4404-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4404-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download