6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462.exe
Size

5.6MB
MD5

b7259cb65d10c3f1d712d537cdac2a18
SHA1

6e791ab189c7951bd29901278d80dbf87d49aa29
SHA256

6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462
SHA512

a601e09709edcc3554256cd30c64ed325b0ab12fdb0b42f27d97c436328ee7dc8f0cde7e808b61a8d6c498ac4a019f37b3e5308aa26eecd38eb4793e03859c99
SSDEEP

98304:F/JoEACwf+BOOY3hGQH1C8HleNVUn5TJ5yNivn5J8ET6Q+:89Vf0OOuH88Fx5TJMS5Fe

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2224	6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-5-0x0000000010000000-0x000000001000B000-memory.dmp	upx
behavioral1/memory/2224-4-0x0000000010000000-0x000000001000B000-memory.dmp	upx
behavioral1/memory/2224-6-0x0000000010000000-0x000000001000B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2224	6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462.exe
2224	6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462.exe

C:\Users\Admin\AppData\Local\Temp\6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462.exe
"C:\Users\Admin\AppData\Local\Temp\6aed12c9951eb4231605aa74caa8bc55437b45fef02265de8cef149143a99462.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230911.lib

Filesize
1.6MB

MD5
031ad1ecd93701d39265771942ec716c

SHA1
cb3ef507bf0e848894fbb96a29bfc94a0c302152

SHA256
9a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba

SHA512
374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae

Download Submit
memory/2224-5-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2224-4-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2224-6-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download