05f8e3a7ec330893f9a24223c3060f1377cd7ffc37474d67342a5e18b36ec4e3

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05f8e3a7ec330893f9a24223c3060f1377cd7ffc37474d67342a5e18b36ec4e3N.exe
Size

236KB
MD5

9ed0cc8502b19dd6d7b45ef07ea42570
SHA1

8156fe89247f90bfb2aa66a2b13fec87d8ff6b5d
SHA256

05f8e3a7ec330893f9a24223c3060f1377cd7ffc37474d67342a5e18b36ec4e3
SHA512

fa1b595c64ce1d43ae757836063220c37330c76a1a0fb2a58bfb1cc3d70f39eba469344f851696a7ad51371d289b93c317a36d7f95e79b6484cd87e460194c5c
SSDEEP

3072:XJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/0/FnncroP9:5wDeM7iNEkgiOb31k1ECCJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1684-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1684-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000d000000023b0d-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05f8e3a7ec330893f9a24223c3060f1377cd7ffc37474d67342a5e18b36ec4e3N.exe

C:\Users\Admin\AppData\Local\Temp\05f8e3a7ec330893f9a24223c3060f1377cd7ffc37474d67342a5e18b36ec4e3N.exe
"C:\Users\Admin\AppData\Local\Temp\05f8e3a7ec330893f9a24223c3060f1377cd7ffc37474d67342a5e18b36ec4e3N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-qOvW6xErm6ULLgso.exe

Filesize
236KB

MD5
74d9ea66cd47f75583ad1aeed3aa0b65

SHA1
6b50cccbf300fd765367be9239d29abe29faa676

SHA256
3da48a8062c87f43680b18435c8bb8f7312432f030927a93853b183d35668e83

SHA512
676c08bb5f9930e4d6d9a03a8900b27fd60326589cac4f0f0d1090e27d1f6dda1f2788c582f6f84200907906cd656f4aa26a7507eca0ec12e661b1f092a2bf87

Download Submit
memory/1684-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1684-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download