60821b081d6841d5b754e368c32140cb965ca0d34e7b88a26e6442bf14cb382b

Analysis

max time kernel
110s
max time network
100s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60821b081d6841d5b754e368c32140cb965ca0d34e7b88a26e6442bf14cb382bN.exe
Size

83KB
MD5

a05aacd4f719bde528f8395e91c3a660
SHA1

50b4423c6139db49f39dec700fb44598c0e13d4f
SHA256

60821b081d6841d5b754e368c32140cb965ca0d34e7b88a26e6442bf14cb382b
SHA512

cf877411eeaa29983863afba77a4cbbf1551b2be454b805b8e17aa6f7a8487ec53c0dc19b8a80c78c9951b6b933dbb227e62e8a63a90f1dcaebe91211d09f7e3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+nK:LJ0TAz6Mte4A+aaZx8EnCGVun

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/320-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/320-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/320-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x003300000001930d-13.dat	upx
behavioral1/memory/320-16-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/320-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60821b081d6841d5b754e368c32140cb965ca0d34e7b88a26e6442bf14cb382bN.exe

C:\Users\Admin\AppData\Local\Temp\60821b081d6841d5b754e368c32140cb965ca0d34e7b88a26e6442bf14cb382bN.exe
"C:\Users\Admin\AppData\Local\Temp\60821b081d6841d5b754e368c32140cb965ca0d34e7b88a26e6442bf14cb382bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-v8OJO2SEZviTVpum.exe

Filesize
83KB

MD5
40eb8df1678b8fe79834ca5f0d1bf0b9

SHA1
456805c14dd2760ad49ec906c68921569f184891

SHA256
da3f56d36a7e36a97cef6e0bcfbf6b029d5ab2c79becca8bf4c6797879121be9

SHA512
dcb02148ae20cf0e6c5710fad6c4673561c7c47eadc0675f89e075d887b43077bb4efaadedcc774c2bcab30f918089efc4e6cb20c9b4064293e8c83414190c38

Download Submit
memory/320-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/320-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/320-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/320-16-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/320-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download