7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cd

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe
Size

83KB
MD5

29d3bd956010825a497320d4efa0dac0
SHA1

537b30460b4ac1ea47f48dee7cc9e2c6e5ac3c30
SHA256

7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cd
SHA512

9db424dd1fc1621ff3a15605dcd525d0ed564aa3ef3408a1b577068d6fd29333508209c9fa597d42311b7847f7413db6d779f8670dfb46c537a1e201d30416df
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2004-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2004-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2004-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2004-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2004-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0015000000023b26-12.dat	upx
behavioral2/memory/2004-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2004-20-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe

C:\Users\Admin\AppData\Local\Temp\7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe
"C:\Users\Admin\AppData\Local\Temp\7f6de3632a109b657e99b765f83042aba1022f42185fb70e00c6fad249fa64cdN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-JkoOdCzHNaOeTUry.exe

Filesize
83KB

MD5
82a981bd49f2efbbe527d5829b1c8228

SHA1
dafc3a66c0ed237673c12fcc9ad4250cb04827e6

SHA256
edcec8b67d3728b17aa58d8cb070d74981aba501adf6fb9903cf48d0229ef7e6

SHA512
73d37f6fd173ba018d19b8d744e645f3301f349ee63ae30efd30451491868329fbdaee117fc0d30d1a72db57e50fcc7c1ab6a89150c6f8a86c769cbc2f2eb118

Download Submit
memory/2004-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2004-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2004-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2004-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2004-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2004-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2004-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download