945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe
Size

83KB
MD5

fc9f2883fbdfea9a253ecf4c5c6efa80
SHA1

6b617060e3b1fabc2ec42279ceb58306d0ff9951
SHA256

945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136
SHA512

fbe7bdf7af8cc7401c85f81e4d15571a210b8d2cc67bed131e9110736ac444d3a688bd2c5e76bf0acf5c2e074cfabaea9f6ce0d5eb9315506d2cc7c797976674
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+7K:LJ0TAz6Mte4A+aaZx8EnCGVu7

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4880-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4880-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4880-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000d000000023b59-11.dat	upx
behavioral2/memory/4880-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4880-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe

C:\Users\Admin\AppData\Local\Temp\945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe
"C:\Users\Admin\AppData\Local\Temp\945ec12f751eda9c2d9e46cd24fd329d39696f2d115a6843e18a0b6c614e6136N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-FiuUTuPufbj20Hye.exe

Filesize
83KB

MD5
595c35866c3abd9385cb542a397a293a

SHA1
3bf89b1a362256840e4b6411e4e54aae871118d2

SHA256
49cf7a350f7bc4c39703550d4590262815184ce3b2b54e97f3997e100ea15520

SHA512
e3e708d2d6b7283697751af1afc46b34f703b05ca3b34ee85459869c6b334ab1cdab951e6a439a45a9dc3a67760326dc78ba69068576e6c89897b4f9df86b76e

Download Submit
memory/4880-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4880-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4880-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4880-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4880-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download