1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe
Size

236KB
MD5

3d67c7f0358d89096f9f57d17d2915a0
SHA1

fc66ccb3a4a56f76be810b966c852eabfda57366
SHA256

1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29
SHA512

ac54b3e04f76cb34d55f65bc0a2d562a2873bb16ff4b84c2dda4e055c2f3cbb98758bf617504fb05e37de417687d97c0771500da1292b0145ebf008320c9d440
SSDEEP

3072:HJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/a/FnncroP9:pwDeM7iNEkgiOb31k1ECsJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2628-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2628-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0033000000019382-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe

C:\Users\Admin\AppData\Local\Temp\1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe
"C:\Users\Admin\AppData\Local\Temp\1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-9VDzwCi8awJ2Komx.exe

Filesize
236KB

MD5
3b0cef46663bf89f5e8228c5d2fe4f66

SHA1
57c6d3d58dd6424c6a0f20209388e79136442d97

SHA256
880a0929b51db0b8654d16398f62f43813c4c30ddaf60ea264b9e13232eb3d61

SHA512
6b4000c7d5ac1266f1ca2803f3307b7e74d571e5a93e1fc9fd855c89fa75a6061a89403980516d9650bd43bc2e8e8a6890f31accfec98642617bcdc0431d230e

Download Submit
memory/2628-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2628-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download