7a979bd8b2640d37c01864ec53ccf870090b80172174e788595846492cf0abb7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a979bd8b2640d37c01864ec53ccf870090b80172174e788595846492cf0abb7N.exe
Size

83KB
MD5

b6f75bb3b903051e8f7bf1c66b9139d0
SHA1

9c37693550f282b5cab47299e44e6ecc5dcaff8f
SHA256

7a979bd8b2640d37c01864ec53ccf870090b80172174e788595846492cf0abb7
SHA512

b393df210b215d46d0c3ca5f302cc0b56784cb64b311cdcda6d8e6717206b2f78d30d14aa0937ea1eb05b79f2e7233e56d9833c0852880d20dff7d7940784ff5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+HK:LJ0TAz6Mte4A+aaZx8EnCGVuH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2764-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2764-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2764-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0003000000013d08-12.dat	upx
behavioral1/memory/2764-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2764-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a979bd8b2640d37c01864ec53ccf870090b80172174e788595846492cf0abb7N.exe

C:\Users\Admin\AppData\Local\Temp\7a979bd8b2640d37c01864ec53ccf870090b80172174e788595846492cf0abb7N.exe
"C:\Users\Admin\AppData\Local\Temp\7a979bd8b2640d37c01864ec53ccf870090b80172174e788595846492cf0abb7N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-FypWBbYajWeQtGFB.exe

Filesize
83KB

MD5
bcb892f1a6d41d39eeb37ea89f175292

SHA1
d7d77a17caa1a6002c69481ef4cb84e5c30f5b6f

SHA256
929f0816ed369e16925e2577c200b495beee652ea2a312cbe022e8acffb3a171

SHA512
29776c1b74b3187c0c831d60d651c54768a16b8a0bd6be06e009c0832bbdac1586157bcb006b23506de44c41ca5e05c692b4cb61ff947ee1fd305c44852bdc3f

Download Submit
memory/2764-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2764-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2764-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2764-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2764-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download