9aa4908e3d8d723da864a0763b432843c9cc05172876754ff32788835fb4003d

Analysis

max time kernel
110s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aa4908e3d8d723da864a0763b432843c9cc05172876754ff32788835fb4003dN.exe
Size

83KB
MD5

2a6599c1b985596add17116b641589a0
SHA1

b6c095ded33d7ff67fd0b6fbef7ca35fb2e92494
SHA256

9aa4908e3d8d723da864a0763b432843c9cc05172876754ff32788835fb4003d
SHA512

4a83099625bcf219405287c9439f335ffd312277d72c7bb47ea216ac1c3ed49ded2bc52fc54469261d714c0fa2eafa3b3aad17c9939880e35b88a08f655cb67d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+cK:LJ0TAz6Mte4A+aaZx8EnCGVuc

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1720-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1720-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1720-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1720-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000d00000001e5c5-12.dat	upx
behavioral2/memory/1720-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1720-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9aa4908e3d8d723da864a0763b432843c9cc05172876754ff32788835fb4003dN.exe

C:\Users\Admin\AppData\Local\Temp\9aa4908e3d8d723da864a0763b432843c9cc05172876754ff32788835fb4003dN.exe
"C:\Users\Admin\AppData\Local\Temp\9aa4908e3d8d723da864a0763b432843c9cc05172876754ff32788835fb4003dN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-E6DHHC1IypCCbZaH.exe

Filesize
83KB

MD5
44edc4a9f3974b9eaaab080e0df37009

SHA1
5cf45f2193b38736a9da432768135fb3b23a71d2

SHA256
bcc96396fe3cefb089428952c95ba4c95e7524d99031dd84d815428c157eb376

SHA512
8c33a9d93f06d1f60f4ad7d8ca6b6a23e1c14f695247b2ef653d99541acf16cc354e44ee1bda82f9a8982f9a24151d3bde1fbb8d5d316d8a71aaeecf3ce9e10c

Download Submit
memory/1720-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1720-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1720-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1720-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1720-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1720-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download