44a755ce12ee371518f4d5989567ebd4ce554ff1b905077f20812acefbc0d8fb

Analysis

max time kernel
111s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44a755ce12ee371518f4d5989567ebd4ce554ff1b905077f20812acefbc0d8fbN.exe
Size

83KB
MD5

34c78e19b5313c5f83ef1fb43e6ab270
SHA1

226192070bbaa9fd5f1e98cd833a501ab5cffa0a
SHA256

44a755ce12ee371518f4d5989567ebd4ce554ff1b905077f20812acefbc0d8fb
SHA512

f722e56e798b9f4a9ba8930856260887d3864c33976ee481ab4afdad57e1299da7dab2980abc9ee79c97a07be4a9f75ad26d9f525a5f99b7e74959bba5a30360
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bK:LJ0TAz6Mte4A+aaZx8EnCGVub

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1772-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1772-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1772-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1772-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000c000000023b65-11.dat	upx
behavioral2/memory/1772-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1772-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44a755ce12ee371518f4d5989567ebd4ce554ff1b905077f20812acefbc0d8fbN.exe

C:\Users\Admin\AppData\Local\Temp\44a755ce12ee371518f4d5989567ebd4ce554ff1b905077f20812acefbc0d8fbN.exe
"C:\Users\Admin\AppData\Local\Temp\44a755ce12ee371518f4d5989567ebd4ce554ff1b905077f20812acefbc0d8fbN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-lMbEkm0grLK4z3NT.exe

Filesize
83KB

MD5
62ba19ce6207ddd0d7950924e9ae220d

SHA1
8d7c28ac27d051eb492b389cbfd9dddd2a64e356

SHA256
a5b33cfadc63667f09d0502bf05dd2118b1d5434930f1169de0d0ee33a71f4f4

SHA512
80cfbafd37d5f93bdd92802fb3dca91a4db2c102a1a23b9d7d03ac57dda94db5ecc77bec46b4913c0f80cc32a8edc4a7399f1914b989214ec64be432eb3a55e6

Download Submit
memory/1772-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1772-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1772-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1772-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1772-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1772-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download