98d4c8a1f28b5b611c9cee7cca5dee60f21af67fc8707c2cdc0ae034e499e011

Analysis

max time kernel
111s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98d4c8a1f28b5b611c9cee7cca5dee60f21af67fc8707c2cdc0ae034e499e011N.exe
Size

83KB
MD5

b2836670211cf202f20d0ba4389a8190
SHA1

78e7d668e79f941f2e7fbedf8fbbacc7a6e3bbc8
SHA256

98d4c8a1f28b5b611c9cee7cca5dee60f21af67fc8707c2cdc0ae034e499e011
SHA512

9d44b701dc234539aad86fcf3045b8af724e6f137ec213dfb9e84572c48c39ab6471f4508748e485f4fee65b5abb13ef1a276e81c3af180cebc200dfb5f6f196
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1624-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1624-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1624-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1624-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0012000000011957-12.dat	upx
behavioral2/memory/1624-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1624-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98d4c8a1f28b5b611c9cee7cca5dee60f21af67fc8707c2cdc0ae034e499e011N.exe

C:\Users\Admin\AppData\Local\Temp\98d4c8a1f28b5b611c9cee7cca5dee60f21af67fc8707c2cdc0ae034e499e011N.exe
"C:\Users\Admin\AppData\Local\Temp\98d4c8a1f28b5b611c9cee7cca5dee60f21af67fc8707c2cdc0ae034e499e011N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-iLjMbuthOj3kA7nG.exe

Filesize
83KB

MD5
498039a58faa39be6f6026131b244903

SHA1
4145812c16d6471579d61853f6958f781b063919

SHA256
740da0b5c48dd1de2256108dba4901b2d51646aae97d1b594ac9de78bd3916b2

SHA512
e1cf9936d315686055269af54c326a2e437f30a05c2f865853eec15bb30ee8d1497c4e240c22b03fc3a6ef252df671ab9577b5f9e97854152ecfb704fe0495ae

Download Submit
memory/1624-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1624-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1624-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1624-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1624-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1624-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download