dc3277701fa6fdf3afd00ccc8c1a1f2cabf5d6300751ab3d600b47d4d0a9cc07

Analysis

max time kernel
111s
max time network
97s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc3277701fa6fdf3afd00ccc8c1a1f2cabf5d6300751ab3d600b47d4d0a9cc07N.exe
Size

83KB
MD5

9737e48642bc5ab60a65e1836271f5e0
SHA1

c176708c39d7f4320c35716640023cda702c9f24
SHA256

dc3277701fa6fdf3afd00ccc8c1a1f2cabf5d6300751ab3d600b47d4d0a9cc07
SHA512

dc12d925d918be122894d89d13ce9ae32fc5ef1fd19b2ed0f87611fa64d44e5585566fb5b6f0934242fb56ec609a2bef56d9eca8a54bd30b75dc560062904867
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+OK:LJ0TAz6Mte4A+aaZx8EnCGVuO

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/844-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/844-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/844-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0004000000018334-11.dat	upx
behavioral1/memory/844-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/844-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc3277701fa6fdf3afd00ccc8c1a1f2cabf5d6300751ab3d600b47d4d0a9cc07N.exe

C:\Users\Admin\AppData\Local\Temp\dc3277701fa6fdf3afd00ccc8c1a1f2cabf5d6300751ab3d600b47d4d0a9cc07N.exe
"C:\Users\Admin\AppData\Local\Temp\dc3277701fa6fdf3afd00ccc8c1a1f2cabf5d6300751ab3d600b47d4d0a9cc07N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-1yGklL42SFnrxFGb.exe

Filesize
83KB

MD5
96a3ed63a6e7ba3056218329f5cbf572

SHA1
22c6f11286ac7a054bcf2b9a55e895770591c7ec

SHA256
67e856d91a21e6e5defc1c9d806ec24b910e6110195a95fa59f117f28cc2770c

SHA512
991ff938868000c1d7a4eb04b57c5a0f5aff8ca758e0751f76d1aa0ddc443b2f3985960bcaffdf06d17626fdd0575e39383e194e3059326ac4650dde7390fe1e

Download Submit
memory/844-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/844-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/844-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/844-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/844-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download