cd44fc7f49d4a0a24869174d1261fdd4f9221ffbfe64fc64a3bb19bca9ca6db8

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd44fc7f49d4a0a24869174d1261fdd4f9221ffbfe64fc64a3bb19bca9ca6db8N.exe
Size

83KB
MD5

d8c9ba26f0af827944528a87bac54300
SHA1

7547e436b74a864acd86f5b2395fd04ba3f7a76d
SHA256

cd44fc7f49d4a0a24869174d1261fdd4f9221ffbfe64fc64a3bb19bca9ca6db8
SHA512

c7d3a08bc21288deaded2a27a93f7bd4e32f3dd08a0fea2223d7d5db8c5832bea55d9ac404a9d0e24301dbdec8f746f3459d46eedcb359dc55750277118a6930
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+iK:LJ0TAz6Mte4A+aaZx8EnCGVui

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2344-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2344-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2344-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2344-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd44fc7f49d4a0a24869174d1261fdd4f9221ffbfe64fc64a3bb19bca9ca6db8N.exe

C:\Users\Admin\AppData\Local\Temp\cd44fc7f49d4a0a24869174d1261fdd4f9221ffbfe64fc64a3bb19bca9ca6db8N.exe
"C:\Users\Admin\AppData\Local\Temp\cd44fc7f49d4a0a24869174d1261fdd4f9221ffbfe64fc64a3bb19bca9ca6db8N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-gs2Yx73pZUGa1n0k.exe

Filesize
83KB

MD5
2102a725b4e76435d45fc1fc3892ca63

SHA1
927bb6416d019c0ff6050f2c02333ebdcc3ef2c9

SHA256
16a53967056515dd7cdd5d6774824a8b235283ad113867bd96e61bc575264626

SHA512
031bbf065994057aaefec09edbb65ffcaa7860aa39327436e1a7bdeae043b3474925a38cb292c4f647db30f0dd4d95c0a8dc0ad9df913f63dd28f0fa6cc439f0

Download Submit
memory/2344-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2344-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2344-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2344-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2344-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download