945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe
Size

83KB
MD5

fc9f2883fbdfea9a253ecf4c5c6efa80
SHA1

6b617060e3b1fabc2ec42279ceb58306d0ff9951
SHA256

945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136
SHA512

fbe7bdf7af8cc7401c85f81e4d15571a210b8d2cc67bed131e9110736ac444d3a688bd2c5e76bf0acf5c2e074cfabaea9f6ce0d5eb9315506d2cc7c797976674
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+7K:LJ0TAz6Mte4A+aaZx8EnCGVu7

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1688-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1688-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1688-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0064000000011c27-11.dat	upx
behavioral1/memory/1688-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1688-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe

C:\Users\Admin\AppData\Local\Temp\945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe
"C:\Users\Admin\AppData\Local\Temp\945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-mE458UJr5qj9Ghy9.exe

Filesize
83KB

MD5
e1562154c0ecf47923c20ff77866dd59

SHA1
bdfca5e925598b1ef9ca15d6f17653f741c54e0d

SHA256
fd2fb3a61790d066bb83227deda09d568ef196e96e1c71f500645c425bc876b1

SHA512
d053614972bb9d0e37f30ca1f5fe26952bedf620c174e54fb5175c6903dd371a639c2550732a7f003d2f06bd93aa595323d592bbf204a3d40ce15774fed81ddc

Download Submit
memory/1688-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1688-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1688-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1688-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1688-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download