e83975dbed06d3f972a7367c8a38c3c6027882406f652d3c3ed46f5c1cf8065f

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e83975dbed06d3f972a7367c8a38c3c6027882406f652d3c3ed46f5c1cf8065f.exe
Size

236KB
MD5

e904dfd9043d585f06e5c5f8ce11be14
SHA1

5a4bf577a657e67711b1bee33e7b72cff54c576e
SHA256

e83975dbed06d3f972a7367c8a38c3c6027882406f652d3c3ed46f5c1cf8065f
SHA512

be01416de4c4c7f3f581aaaa535378c166909c24d862f26cb91239c3b8d9cf1543bd7fb7bd0ed0b7c29ef010ea59310f4e28dffe8f678c9f6c63a704f2d6c633
SSDEEP

3072:ZJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/J/FnncroP9:jwDeM7iNEkgiOb31k1EC1J/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1516-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1516-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0010000000023a82-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e83975dbed06d3f972a7367c8a38c3c6027882406f652d3c3ed46f5c1cf8065f.exe

C:\Users\Admin\AppData\Local\Temp\e83975dbed06d3f972a7367c8a38c3c6027882406f652d3c3ed46f5c1cf8065f.exe
"C:\Users\Admin\AppData\Local\Temp\e83975dbed06d3f972a7367c8a38c3c6027882406f652d3c3ed46f5c1cf8065f.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-GQZ2IegocYRRR7j3.exe

Filesize
236KB

MD5
09e8bdb58212e516421156e7728d300b

SHA1
b7f5ee042c82b8beb4959c9cd86c5219cbc25f7a

SHA256
5ad3eb5f2487e543fa629bd614e4a6a705069f1365b6219d619bed90fe31df88

SHA512
dcb81a008a769d7d482585e1fa1fb850df9ae2fd5fc210749890c30d18fe7e077a11f8d71b6bfdf2ddb65a8f7f3a5737ffab961fa03eae4a38f114094887ecae

Download Submit
memory/1516-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1516-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download