376d1312a77e0fa925640e39d9d662e3ffc714ae26a64e694eb53cf6fc4d9cd8

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

376d1312a77e0fa925640e39d9d662e3ffc714ae26a64e694eb53cf6fc4d9cd8N.exe
Size

236KB
MD5

b6c981163eef538e225c9ab1a4f2ac80
SHA1

318d41ea3c4d1734af437ab62ff13a386bc7e8e0
SHA256

376d1312a77e0fa925640e39d9d662e3ffc714ae26a64e694eb53cf6fc4d9cd8
SHA512

08740aff21b1c1a5e087ed8441d17fda6f4b9519e58e317f5bec1773efae071080662952ec895a58e50d5ee840f889021d54008ed2ff0918015247f3788887d2
SSDEEP

3072:LJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/j/FnncroP9:NwDeM7iNEkgiOb31k1ECDJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2460-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2460-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x00120000000239d2-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	376d1312a77e0fa925640e39d9d662e3ffc714ae26a64e694eb53cf6fc4d9cd8N.exe

C:\Users\Admin\AppData\Local\Temp\376d1312a77e0fa925640e39d9d662e3ffc714ae26a64e694eb53cf6fc4d9cd8N.exe
"C:\Users\Admin\AppData\Local\Temp\376d1312a77e0fa925640e39d9d662e3ffc714ae26a64e694eb53cf6fc4d9cd8N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-EbFyk6JnTXAd0ism.exe

Filesize
236KB

MD5
429f3a4dfd3096a2b2b18cbac5fd2895

SHA1
43f296301757d88949d9a082c32015f8070a3ff1

SHA256
de0d5ef3823c8c5b3dc719bab3371dde2d1d24fd3223c277522d9cf9a9696cd2

SHA512
d5a29576f40d2a36b36b70d1208eaeffcf71d5b3fbb6d9d2c74f938681c7834f54cc022cb23c2d681e58cc8204c2cc7c150ec317181adfed71104a6463b7ed1b

Download Submit
memory/2460-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2460-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download