b75c0283f9c347e3691b9903df77d14501a76a62535eee500a177b4c6b71ef4b

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b75c0283f9c347e3691b9903df77d14501a76a62535eee500a177b4c6b71ef4bN.exe
Size

236KB
MD5

47c450a5944cba9205db667e184a22e0
SHA1

470d9ed9caa1635f70e2ee3bb8847da5365317b3
SHA256

b75c0283f9c347e3691b9903df77d14501a76a62535eee500a177b4c6b71ef4b
SHA512

a26860c27558ef96de2d211b435aa588a30b660f3b8e99a7a656202d8c88e9ff7a0053475d0a4724369c8efa834938e540de6c5e182607c290249918147d4d7a
SSDEEP

3072:SJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/q/FnncroP9:GwDeM7iNEkgiOb31k1ECsJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2252-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2252-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000d000000023ab7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b75c0283f9c347e3691b9903df77d14501a76a62535eee500a177b4c6b71ef4bN.exe

C:\Users\Admin\AppData\Local\Temp\b75c0283f9c347e3691b9903df77d14501a76a62535eee500a177b4c6b71ef4bN.exe
"C:\Users\Admin\AppData\Local\Temp\b75c0283f9c347e3691b9903df77d14501a76a62535eee500a177b4c6b71ef4bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-HUQ84nzYEgYm4ih2.exe

Filesize
236KB

MD5
1a57cb5b83e289d31241f6517122cb74

SHA1
62644e6374cbb7d6113acc92e9e75988d0da37c6

SHA256
eeb917e849ae0113949eb487b93d53db0d96d152609836dac2407ae6d387e0b7

SHA512
a75f0b0e5c7745ddd1155988bc0ad4047e8faa18d1e7585400333befe905b36d8b5c860f305790222f16edda118f3a662984789830fa60a9f7b302e12c89775e

Download Submit
memory/2252-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2252-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download