75eb2a26321fd53b80dce45ff5a685f5d948f0390e401277231ab6cec2d4d589

Analysis

max time kernel
112s
max time network
96s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75eb2a26321fd53b80dce45ff5a685f5d948f0390e401277231ab6cec2d4d589N.exe
Size

83KB
MD5

3245f47503ecfa4cc2c477fcdd223e30
SHA1

f62564c65dc1deddc59af9c365c0fea5c7db93b0
SHA256

75eb2a26321fd53b80dce45ff5a685f5d948f0390e401277231ab6cec2d4d589
SHA512

2b2c53011904aa451db480931e0d8d15e6890bc42a5c329cf8d90cc4bd86409b3122e1ea8a6b805889cdd1140c4a8b92635b0e4550ea8f35ad04cd3a7189e11d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+EK:LJ0TAz6Mte4A+aaZx8EnCGVuE

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2364-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2364-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0009000000012101-11.dat	upx
behavioral1/memory/2364-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2364-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75eb2a26321fd53b80dce45ff5a685f5d948f0390e401277231ab6cec2d4d589N.exe

C:\Users\Admin\AppData\Local\Temp\75eb2a26321fd53b80dce45ff5a685f5d948f0390e401277231ab6cec2d4d589N.exe
"C:\Users\Admin\AppData\Local\Temp\75eb2a26321fd53b80dce45ff5a685f5d948f0390e401277231ab6cec2d4d589N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-rDEVklF9CADhMFDT.exe

Filesize
83KB

MD5
c62e4158d3dc94e81a041f56d7f2c11e

SHA1
8dfd421d9f3110fe2559e12f4b89f93d097a74b7

SHA256
0a6a7defde26bd2d6d07df1d7b8e7dc540cfe0e308a84ff17843277bee6c1b83

SHA512
05cc212c8a8959d38f3e94bd508f3871f457c622776091867005661fd528aa60c530ed1583751a4e204e8a756a92f0026ae149fa7b2ac587f471dc778def80b3

Download Submit
memory/2364-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2364-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2364-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2364-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2364-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download