9d1307bbcc83485ca5e7f0e7d4a4f92178ab0a9325da65fb561f55cefc317fb1

Analysis

max time kernel
92s
max time network
93s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d1307bbcc83485ca5e7f0e7d4a4f92178ab0a9325da65fb561f55cefc317fb1N.exe
Size

236KB
MD5

00084b87a7a58c9fef06a0484ea12880
SHA1

5183fcac2d3792339bbf25350cd013412fc23999
SHA256

9d1307bbcc83485ca5e7f0e7d4a4f92178ab0a9325da65fb561f55cefc317fb1
SHA512

4d4b565167b5c60fa02954ad3e9322eed458383abf7c500b03def1e0c772b2590a6bd03c938376fb9890a659d0817e437cc15cc306bbaf22cd6a9ab98a9aa480
SSDEEP

3072:DJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/X/FnncroP9:FwDeM7iNEkgiOb31k1ECHJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2692-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d1307bbcc83485ca5e7f0e7d4a4f92178ab0a9325da65fb561f55cefc317fb1N.exe

C:\Users\Admin\AppData\Local\Temp\9d1307bbcc83485ca5e7f0e7d4a4f92178ab0a9325da65fb561f55cefc317fb1N.exe
"C:\Users\Admin\AppData\Local\Temp\9d1307bbcc83485ca5e7f0e7d4a4f92178ab0a9325da65fb561f55cefc317fb1N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-fSMrVkRG8y8djsGb.exe

Filesize
236KB

MD5
fa3667f25ab5f3f7435f19a6ae5e09d7

SHA1
7fa46fe96b0891948f1625357e77df17f30e26b4

SHA256
2239905832a3de8a826eb45b30dacd0ac814261e894bdae6633392afd1119b5c

SHA512
70e1f673ed15316603e02745edc76e64f7b7460ac336f7554753fbec9558c7dad2e44e743c3d295556d5cc5053dc573f8aab22bf905a110b030e23e2c7d14caa

Download Submit
memory/2692-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2692-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download