9ce2008e45a053b722b5ca7af6eba97d2b7052741512d19b80fffac47547af34

Analysis

max time kernel
111s
max time network
99s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ce2008e45a053b722b5ca7af6eba97d2b7052741512d19b80fffac47547af34N.exe
Size

83KB
MD5

9982a0df9dda7ad309e5550c09e043a0
SHA1

b752edee9f7a3ce64abe59e53f6edb3dc1ffb736
SHA256

9ce2008e45a053b722b5ca7af6eba97d2b7052741512d19b80fffac47547af34
SHA512

1ab790952ca2c6789a79328920d26e99a3278f40b4f9881e08398c020057e7eb1d962c9e0649bc13ce54a8b671658d8c4860f7992b6369120066675cb203e7eb
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YK:LJ0TAz6Mte4A+aaZx8EnCGVuY

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2952-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2952-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2952-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000b000000012250-12.dat	upx
behavioral1/memory/2952-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2952-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ce2008e45a053b722b5ca7af6eba97d2b7052741512d19b80fffac47547af34N.exe

C:\Users\Admin\AppData\Local\Temp\9ce2008e45a053b722b5ca7af6eba97d2b7052741512d19b80fffac47547af34N.exe
"C:\Users\Admin\AppData\Local\Temp\9ce2008e45a053b722b5ca7af6eba97d2b7052741512d19b80fffac47547af34N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-hzwPpon5N7QQx0m9.exe

Filesize
83KB

MD5
9b4107e195bcaf79bbe3549e9d783b5e

SHA1
8eedd3e6fd04e5f61a9e20b36708c33118cda3ff

SHA256
d7bbd6c0e7f7a9d370da4a8d5f6368cd7f9dab73e0a05d6d2940d261874b8f21

SHA512
4e37f0bd79fa62880a1d7d5253811462f40404cbab9ece63dc5158170c355f62b17482a7502062ec5fa3013c7c3213a1f7fcff447c2aa3d4e2fce790be7dbb03

Download Submit
memory/2952-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2952-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2952-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2952-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2952-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download