7c7458c87c4cb8475a04a61b72da0582f4286b7c9036cc230087fb2e6f20afb5

Analysis

max time kernel
111s
max time network
102s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c7458c87c4cb8475a04a61b72da0582f4286b7c9036cc230087fb2e6f20afb5N.exe
Size

83KB
MD5

84510fb686dc335e15d79f3f40bd82a0
SHA1

8d4a12304ded451ee744e551b9693b2db741f603
SHA256

7c7458c87c4cb8475a04a61b72da0582f4286b7c9036cc230087fb2e6f20afb5
SHA512

6243cdef2e2a5364d7eb6a16b5700d45a426ebe04ba3754c21f4df3388a6f82ad1933916592818c20767af874c85b151c54972ef67ea83a6db97d095fb86a55a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:LJ0TAz6Mte4A+aaZx8EnCGVuW

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2260-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2260-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2260-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000b000000012250-11.dat	upx
behavioral1/memory/2260-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2260-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c7458c87c4cb8475a04a61b72da0582f4286b7c9036cc230087fb2e6f20afb5N.exe

C:\Users\Admin\AppData\Local\Temp\7c7458c87c4cb8475a04a61b72da0582f4286b7c9036cc230087fb2e6f20afb5N.exe
"C:\Users\Admin\AppData\Local\Temp\7c7458c87c4cb8475a04a61b72da0582f4286b7c9036cc230087fb2e6f20afb5N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-WeKTBDbDL8AnGzHL.exe

Filesize
83KB

MD5
26ca9c1878e3de7704036cfae89d5985

SHA1
c81ff46a447450b5de8c97bd9421c6aae2b4b3a2

SHA256
874bd2fc34b6df044a8be32bfea2f408b6572b2c30564c32d6b3366c90715b32

SHA512
f9d47e79e990066aa32e84a8f32759475adce600f5b7fcfd5904d998faed9f0c0996f15c2235723348a0e5ac86c1cfc5cc811ca5503672ccf0f42f6b80bd86a1

Download Submit
memory/2260-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2260-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2260-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2260-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2260-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download