cd9d272353e672e8edddfc47b3c945a93e98b12f498ea34893b8cfb2f6836442

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd9d272353e672e8edddfc47b3c945a93e98b12f498ea34893b8cfb2f6836442N.exe
Size

83KB
MD5

626ff162baee9527e2c3e0c12878bb20
SHA1

98f17853ae4232dcbedba302e2cf46caaa7434c7
SHA256

cd9d272353e672e8edddfc47b3c945a93e98b12f498ea34893b8cfb2f6836442
SHA512

73c689a8209d1d525e448abc01d8e2e2f1b4c00bbec1c89ab3eb989a06f49f023268e7024a66448fee06b3000587afcbab7cfbcd617fd521c25fa5702feefb4a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+EK:LJ0TAz6Mte4A+aaZx8EnCGVuE

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/548-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/548-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/548-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/548-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023464-11.dat	upx
behavioral2/memory/548-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/548-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd9d272353e672e8edddfc47b3c945a93e98b12f498ea34893b8cfb2f6836442N.exe

C:\Users\Admin\AppData\Local\Temp\cd9d272353e672e8edddfc47b3c945a93e98b12f498ea34893b8cfb2f6836442N.exe
"C:\Users\Admin\AppData\Local\Temp\cd9d272353e672e8edddfc47b3c945a93e98b12f498ea34893b8cfb2f6836442N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-2lCOh4n33LlJMco9.exe

Filesize
83KB

MD5
e005b92c7efe19498cf12a53820fc407

SHA1
38164261c314a5f3961b0ce4bf94dc278ada4b45

SHA256
9305aea887940fdb9e0b203d02004e7faf1642f969ba22a8f865a4d4ac9e3bd9

SHA512
525d14b2692e3839178bd451f960db3496df5ce8824daf93b4d5e7dd460e16fdbd4916c2a5fe1d3e515816568bb49582510ae628d048e2b14a921bb5c26b15a6

Download Submit
memory/548-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/548-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/548-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/548-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/548-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/548-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download