c38cc8fb069b26ab5ae0a06b4df825d69371ef6d13b92f6a004d4a026ddcbc68

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c38cc8fb069b26ab5ae0a06b4df825d69371ef6d13b92f6a004d4a026ddcbc68N.exe
Size

236KB
MD5

2e4e22a762e5bacefa38cd589c145200
SHA1

375886f742cd563d4b0927288ea3ce7733a7c035
SHA256

c38cc8fb069b26ab5ae0a06b4df825d69371ef6d13b92f6a004d4a026ddcbc68
SHA512

b86ba1768c3963210c8f1178c29d5e2851a88e14f5a73ed369b711f491e8931ec43eab45a4cafca4d01445f4f895f10511367ec2aee68106407fdb739bb09ec7
SSDEEP

3072:MJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/K/FnncroP9:QwDeM7iNEkgiOb31k1ECcJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1708-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c38cc8fb069b26ab5ae0a06b4df825d69371ef6d13b92f6a004d4a026ddcbc68N.exe

C:\Users\Admin\AppData\Local\Temp\c38cc8fb069b26ab5ae0a06b4df825d69371ef6d13b92f6a004d4a026ddcbc68N.exe
"C:\Users\Admin\AppData\Local\Temp\c38cc8fb069b26ab5ae0a06b4df825d69371ef6d13b92f6a004d4a026ddcbc68N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-fM0pfPoW6teNvYB5.exe

Filesize
236KB

MD5
972bfe09223c31757ee445e4a057de24

SHA1
188e32771b96b0a71291aeae56624e96b5e9e12c

SHA256
0671d656b508efa78061a0edf0dea26593a693212abcf29b4056bfbe552a9045

SHA512
47961594de3c8eb188ea1025af41ae7877732cb468598f4106c6d283bf423a1d6b90842463e694502bfa490ce3336b23c03fc73e14d524c979250bafb679a0ec

Download Submit
memory/1708-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download