7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cd

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe
Size

83KB
MD5

29d3bd956010825a497320d4efa0dac0
SHA1

537b30460b4ac1ea47f48dee7cc9e2c6e5ac3c30
SHA256

7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cd
SHA512

9db424dd1fc1621ff3a15605dcd525d0ed564aa3ef3408a1b577068d6fd29333508209c9fa597d42311b7847f7413db6d779f8670dfb46c537a1e201d30416df
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1308-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1308-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1308-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x00090000000120fe-11.dat	upx
behavioral1/memory/1308-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1308-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe

C:\Users\Admin\AppData\Local\Temp\7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe
"C:\Users\Admin\AppData\Local\Temp\7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-0wM9ykPkP3pZ20LD.exe

Filesize
83KB

MD5
8e7b388859c0d612987c96370ff5fcd8

SHA1
9f423b6e6cb584a96616096fd17867c5479bee02

SHA256
351ac4d42ae0bec4e30bcd1acec8488f26d2be2052dfd39437db7db97801d3d8

SHA512
7f2cc6ff463c691e04ad67a9bc9abcb90cbcb5bacbdce7a0328873e2eaac05cab4fb7f2ad809648fc8291b26de0e9d02aa4511384062683b12ae20ac433799e5

Download Submit
memory/1308-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1308-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1308-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1308-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1308-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download