2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe
Size

236KB
MD5

721a043c655e20ec66d9f58874c1a9d0
SHA1

63d188116008c43b077308fe7ff22cd823c8c7e6
SHA256

2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7
SHA512

7d29ac6733985f3cd74ab121cd20f6e4576d00056a15ee11742e6f908b123e15f940984f828bbdce67c9232a093b6515ef16bf2ce26d56f69bd83d9f14451563
SSDEEP

3072:hJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/FnncroP9:rwDeM7iNEkgiOb31k1ECpJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1480-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1480-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0008000000023481-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe

C:\Users\Admin\AppData\Local\Temp\2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe
"C:\Users\Admin\AppData\Local\Temp\2706a58cec4f7a0dec32d2a1513447cb17cd06d1e234d008cd2dc69d1a4468b7N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-EHFp5tyAkIPojLn9.exe

Filesize
236KB

MD5
04313cc5a808d164dad895c85e0766ed

SHA1
fa64578de40fef066831e93d1337153b7a77f1cb

SHA256
edb5e0ee8cca9027e0c00c211fa36c65febe15178af5f7e2c9b5f217fda28d1c

SHA512
d516c498f903af47a710ded67047dbaf23c85990ab09394c4dcdd9ef727b877d7f416f98ea6d54a83fff8817d048a7c09e40f33c41f67ea3477db43d16ae598c

Download Submit
memory/1480-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1480-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download