2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe
Size

236KB
MD5

721a043c655e20ec66d9f58874c1a9d0
SHA1

63d188116008c43b077308fe7ff22cd823c8c7e6
SHA256

2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7
SHA512

7d29ac6733985f3cd74ab121cd20f6e4576d00056a15ee11742e6f908b123e15f940984f828bbdce67c9232a093b6515ef16bf2ce26d56f69bd83d9f14451563
SSDEEP

3072:hJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/FnncroP9:rwDeM7iNEkgiOb31k1ECpJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2776-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2776-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000b000000012250-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe

C:\Users\Admin\AppData\Local\Temp\2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe
"C:\Users\Admin\AppData\Local\Temp\2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-QC3MA2AswBz5H6zn.exe

Filesize
236KB

MD5
90d520d22117d2dba98dcf34bf56c505

SHA1
3268ea70af9526ea7464d170acae1d39d7021df7

SHA256
99c6512bc448ba92222c36dc1f044b0326cca1d56f1acd10d035e8fd624f4555

SHA512
2eb2d1f8a8f35ee54dc4f6bcd9499229c3c9930acb91cfddd63d78f4dfe2dc64f2181a843f31b977aa256f168a3d09af74619f07bb7a76b5af858576a2e864e0

Download Submit
memory/2776-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2776-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download