1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe
Size

236KB
MD5

3d67c7f0358d89096f9f57d17d2915a0
SHA1

fc66ccb3a4a56f76be810b966c852eabfda57366
SHA256

1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29
SHA512

ac54b3e04f76cb34d55f65bc0a2d562a2873bb16ff4b84c2dda4e055c2f3cbb98758bf617504fb05e37de417687d97c0771500da1292b0145ebf008320c9d440
SSDEEP

3072:HJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/a/FnncroP9:pwDeM7iNEkgiOb31k1ECsJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2216-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2216-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000e000000023a3f-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe

C:\Users\Admin\AppData\Local\Temp\1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe
"C:\Users\Admin\AppData\Local\Temp\1847862ecd563d52222ee8f4112797face50b52d7a0af8faf3c6792961f25f29N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-qSgumhFGO18ILejU.exe

Filesize
236KB

MD5
eb3c3f8e1d30bfd58c39bdd46fa957ac

SHA1
f02fbcad30d5d34c9fb5eece27733237ff81281b

SHA256
88329e9d4a383c666f71cd298d77ae3615542972e1afaa7531d87d402a44d668

SHA512
ba9abb5ec847d63fba1aa4671c3902bd3df96482fdeb48f5ea411894321ef711a281e2c9582e1806898d152827e8c56a32c841ed2a77f0d2aa6b14b0beef4698

Download Submit
memory/2216-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2216-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download