b5b5bbc54d075d9ee2fa7518639956b52d3e26b718b6f9cc211f116501aace08

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b5bbc54d075d9ee2fa7518639956b52d3e26b718b6f9cc211f116501aace08N.exe
Size

83KB
MD5

8968d6c3acf16aaed473dbab73d442e0
SHA1

c1d7598a065e93b3e9a13fb66351029b590b65d4
SHA256

b5b5bbc54d075d9ee2fa7518639956b52d3e26b718b6f9cc211f116501aace08
SHA512

33d41cfb1e06f9599d5ec461f4ecaded3a47d074c0975bb8d4647e60c88b22029afa989fc910df7a2505f25796adff68d6ef00ec7baaccc511b93f16dfc3b4df
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+BK:LJ0TAz6Mte4A+aaZx8EnCGVuB

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1800-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1800-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1800-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0010000000023b2a-11.dat	upx
behavioral2/memory/1800-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1800-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5b5bbc54d075d9ee2fa7518639956b52d3e26b718b6f9cc211f116501aace08N.exe

C:\Users\Admin\AppData\Local\Temp\b5b5bbc54d075d9ee2fa7518639956b52d3e26b718b6f9cc211f116501aace08N.exe
"C:\Users\Admin\AppData\Local\Temp\b5b5bbc54d075d9ee2fa7518639956b52d3e26b718b6f9cc211f116501aace08N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-rfFt03HK8AFTteGr.exe

Filesize
83KB

MD5
18530a39bc8145d0ebbe01bba7457796

SHA1
c6ab33d5dcee1fd5267762f1e4061b3eca3c3388

SHA256
e277718cc7f5ecec62a653af796926fa1466e757900afa4afb439afcb46bf5a5

SHA512
4d96cda2d24aaa07cea03e51a923441799650f1fe9868c88170030b6f16432c2bda47653d152afa6e882d06e3405ec09702747ab17795ba47ac3ae891bb54dc1

Download Submit
memory/1800-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1800-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1800-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1800-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1800-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download