e4bc7fdc3b3644b5721882d28ad13d1bd31356997b5d51511318a3966897d1b0

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e4bc7fdc3b3644b5721882d28ad13d1bd31356997b5d51511318a3966897d1b0N.exe
Size

83KB
MD5

373da7cc53dae564d695f28fdadeae20
SHA1

273a23595b0139c4ef360486cd4d010588003755
SHA256

e4bc7fdc3b3644b5721882d28ad13d1bd31356997b5d51511318a3966897d1b0
SHA512

2e8d04d43fde6f592308574506c162640e9128c34fa7b9c4b236ce4bab51df53a7f80844da68a23bccb93ded9278ff7db5f3f33a51efae70359890b24d687219
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2704-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2704-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2704-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x003a000000018662-11.dat	upx
behavioral1/memory/2704-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2704-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4bc7fdc3b3644b5721882d28ad13d1bd31356997b5d51511318a3966897d1b0N.exe

C:\Users\Admin\AppData\Local\Temp\e4bc7fdc3b3644b5721882d28ad13d1bd31356997b5d51511318a3966897d1b0N.exe
"C:\Users\Admin\AppData\Local\Temp\e4bc7fdc3b3644b5721882d28ad13d1bd31356997b5d51511318a3966897d1b0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-o97q9UBB0u3fy4Ux.exe

Filesize
83KB

MD5
57662690427c68d3e844f41a9acf308b

SHA1
cb15f3be84f5cc8326c5c304ad0f607a7a96cb24

SHA256
c1a26bf4aa246c86ba31aa6703a61107f088aa9aed137f4034c36b18414c56d1

SHA512
9ba7ad72e3ba52d6bd96fea3cb17dfba471a80bd4e2bedf6e88e2982f19b64e1f287b0d44142a72e486163350dae746119355a94a7482bb4262dd02fdf8aaf09

Download Submit
memory/2704-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2704-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download