54849b17ecb70e131749896ab7808045def2242ca657d2d55f099bd679ac6c30

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54849b17ecb70e131749896ab7808045def2242ca657d2d55f099bd679ac6c30N.exe
Size

236KB
MD5

372ad6fe5725746a3c4edbbd18b56b60
SHA1

a63eda096271ab5d0f8712bedec68a00db7099ce
SHA256

54849b17ecb70e131749896ab7808045def2242ca657d2d55f099bd679ac6c30
SHA512

68da807d6db011dbe3684f3ede4d7583bede8160308799e64d99e233e086befc2b0c866bf90cbc4454d89914c0ed25f562a0ccb5a3568b2dc5ed1684a2150cb0
SSDEEP

3072:lJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/v/FnncroP9:vwDeM7iNEkgiOb31k1ECfJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1240-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1240-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000300000000aefb-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54849b17ecb70e131749896ab7808045def2242ca657d2d55f099bd679ac6c30N.exe

C:\Users\Admin\AppData\Local\Temp\54849b17ecb70e131749896ab7808045def2242ca657d2d55f099bd679ac6c30N.exe
"C:\Users\Admin\AppData\Local\Temp\54849b17ecb70e131749896ab7808045def2242ca657d2d55f099bd679ac6c30N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-bSQDDw0xEPAEeTCt.exe

Filesize
236KB

MD5
ca29c5edee9cfb35e510252d63c275ae

SHA1
e313bd37fc35343655caaf375d042f37b959559d

SHA256
c4a298b816823e66ca9ebcf4a9599d0cddbad149990463b2cd10b3bb9e7d4c85

SHA512
ecfb1744a515a23cc6d46e17c729549571d8921ad37286384a762746528a7779f72c5aefbf49f1aaa4a439b7770676594bf9bdb9a763cae3e2fcfe2b9be816b3

Download Submit
memory/1240-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1240-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download