6c990da260c02f8a1e2fd882d9247edfaf7449e53a18a221143b99f32c075bd0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c990da260c02f8a1e2fd882d9247edfaf7449e53a18a221143b99f32c075bd0N.exe
Size

83KB
MD5

f0e2056f78a9cb2658bfa2b2bdf9cc10
SHA1

c57df798c4705d4efe9fefced4c1ec92f2d8b1ac
SHA256

6c990da260c02f8a1e2fd882d9247edfaf7449e53a18a221143b99f32c075bd0
SHA512

18bda73c39b3b59131c83dd0d75bf578ded9f2b0d8d1a8b42cd7d3c24dac67ce56a4cac80ba8356759edbce8e82011c687a5d515255d34d4f101a46ada2caad3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF++K:LJ0TAz6Mte4A+aaZx8EnCGVu+

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2720-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2720-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2720-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2720-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2720-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c990da260c02f8a1e2fd882d9247edfaf7449e53a18a221143b99f32c075bd0N.exe

C:\Users\Admin\AppData\Local\Temp\6c990da260c02f8a1e2fd882d9247edfaf7449e53a18a221143b99f32c075bd0N.exe
"C:\Users\Admin\AppData\Local\Temp\6c990da260c02f8a1e2fd882d9247edfaf7449e53a18a221143b99f32c075bd0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-upKUPO4ShbxNqZDq.exe

Filesize
83KB

MD5
83e14fa07e27e3be3806923c2d616d84

SHA1
1469380ec72f33575a582f0774fadab5f4888a2c

SHA256
35d3785fcfd7b08dafd76d37916dd0b95ee76bfde4ebad4994ac3e25555c1b17

SHA512
45e8c3a1ff0c26ed9171e2c28138566d09b387e323624fafcf59acdc4fcec793ed878c9f63ff6a540dba09bb0aac94532d290d5f565f115ab363b36312b7a58e

Download Submit
memory/2720-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2720-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2720-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2720-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2720-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download