e910a5902b1b9fe58d7cd9864d802b8ed5fac5b462f046dbaa716e4afd405486

Analysis

max time kernel
122s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e910a5902b1b9fe58d7cd9864d802b8ed5fac5b462f046dbaa716e4afd405486.exe
Size

236KB
MD5

f8530de553fd2dde15b13e101b2d063b
SHA1

dd50c2d4240ff0e655873891178b7d9b3c485bfe
SHA256

e910a5902b1b9fe58d7cd9864d802b8ed5fac5b462f046dbaa716e4afd405486
SHA512

8b7ea0bb120b77945dee9168a61ddb83f8154de92ccf75dc1585bf9cf786ea574e68f559f9fcdd747719f0ed247d8f8d8e41ff3eebdace62600ae02d31cae279
SSDEEP

3072:8J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/v/FnncroP9:AwDeM7iNEkgiOb31k1ECvJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4540-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4540-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000d000000023a95-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e910a5902b1b9fe58d7cd9864d802b8ed5fac5b462f046dbaa716e4afd405486.exe

C:\Users\Admin\AppData\Local\Temp\e910a5902b1b9fe58d7cd9864d802b8ed5fac5b462f046dbaa716e4afd405486.exe
"C:\Users\Admin\AppData\Local\Temp\e910a5902b1b9fe58d7cd9864d802b8ed5fac5b462f046dbaa716e4afd405486.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-MteoczXUEqYRlUQK.exe

Filesize
236KB

MD5
e9f9f0adb1b06385b21aba93a970e848

SHA1
2b7a734b085bf6c1e066dfaf46fbdec41967ce5d

SHA256
72d2c62208b8bb209a8ebd7c140eb76b0729a15d450bce356f1cb012ab28feda

SHA512
bc9317b4abe7dde1cfc374a3eb08ca669b5b92b952fda3f8883747f95a2ed413888efaa276aa096b7701bca2a5e3ec2c64a979bf3670fae127d00f9604e6a070

Download Submit
memory/4540-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4540-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download