a93aef26dc371999c4bb77994eaa0084e8056f14761db87efc44f8f689cc894d

Analysis

max time kernel
92s
max time network
93s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a93aef26dc371999c4bb77994eaa0084e8056f14761db87efc44f8f689cc894dN.exe
Size

236KB
MD5

64652b60b3214648a02afd4a2d7fb1e0
SHA1

8b5e66fd6fb67004eba12a5b974ae715eddcfe79
SHA256

a93aef26dc371999c4bb77994eaa0084e8056f14761db87efc44f8f689cc894d
SHA512

47664e8f562d46a6abbb37f3d29fd4b26785306fe5c0001c8a610d3c38e24ed206ec12a7e8501ed46a9daccb7c2c3be11402ceac443f204dad4493575cd2f98f
SSDEEP

3072:1J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/B/FnncroP9:/wDeM7iNEkgiOb31k1ECtJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2352-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2352-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a93aef26dc371999c4bb77994eaa0084e8056f14761db87efc44f8f689cc894dN.exe

C:\Users\Admin\AppData\Local\Temp\a93aef26dc371999c4bb77994eaa0084e8056f14761db87efc44f8f689cc894dN.exe
"C:\Users\Admin\AppData\Local\Temp\a93aef26dc371999c4bb77994eaa0084e8056f14761db87efc44f8f689cc894dN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-lLIPboluUCbQX66J.exe

Filesize
236KB

MD5
f7051fa76d147a12bab4c5ce2ebc8748

SHA1
170b3157820f11041cb9726107fa4181430a4b8a

SHA256
15367150f4af14f7499b0f224c3ef05ccfa9007e6c4a45ee11b6c1649c4ed612

SHA512
8f4d0991ac8bf9f724b86a0cae317a1ae719515bb71614cab6f2385a0697c99f28c6eb1581c41221683b8bbea9de1cd7351ad6449410700eba926cc5c07a470b

Download Submit
memory/2352-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2352-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download