d09f884245f26b3f00689ac1d640749ec118ef36dbac9738edf55c9adfa48622

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d09f884245f26b3f00689ac1d640749ec118ef36dbac9738edf55c9adfa48622N.exe
Size

83KB
MD5

88b6b2382f744505c14eb243528818d0
SHA1

d29c4ea4ae35c1001cd9cee1673f8a348dddb1c4
SHA256

d09f884245f26b3f00689ac1d640749ec118ef36dbac9738edf55c9adfa48622
SHA512

ae28bb1952d670ba54a318ba1537093b30655485e987ad97c9bb07ebd91d4b80dc12ba24ea1972494438a95c19873d95a779704215d5bcda52694fb308d8cf94
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1884-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1884-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1884-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000c0000000122cf-11.dat	upx
behavioral1/memory/1884-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1884-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d09f884245f26b3f00689ac1d640749ec118ef36dbac9738edf55c9adfa48622N.exe

C:\Users\Admin\AppData\Local\Temp\d09f884245f26b3f00689ac1d640749ec118ef36dbac9738edf55c9adfa48622N.exe
"C:\Users\Admin\AppData\Local\Temp\d09f884245f26b3f00689ac1d640749ec118ef36dbac9738edf55c9adfa48622N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-L5594ZaHLEwfHKHt.exe

Filesize
83KB

MD5
94b23a90a7d78bf9ff49de1938179ce0

SHA1
61147f39bc00a466660d8fdb5f8d6181f259a9ee

SHA256
e7725945bf2e1b617fd76f08fe01f0441befd74f5fc81bf734a1a74eac5bcbff

SHA512
671941a4ae1d7bdf9dd651556b0dc99bc52e8a2a2439e8ea902e21c742828a35e63cc564f05c31b876b676c05e8d188c319e2f51872ece62c3469a1417021740

Download Submit
memory/1884-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1884-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1884-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1884-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1884-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download