cc62ce48b419162757eec4678c2f9852a053a473758c2009303621bf5e9adf41

Analysis

max time kernel
120s
max time network
92s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc62ce48b419162757eec4678c2f9852a053a473758c2009303621bf5e9adf41N.exe
Size

83KB
MD5

a434c515b356bad208fdb262929334a0
SHA1

ad5a1c84ec07143f55b963e5ebae83f956f1f2c4
SHA256

cc62ce48b419162757eec4678c2f9852a053a473758c2009303621bf5e9adf41
SHA512

106f67922ebf6eb534a8bda5fca8249006a3cb32e0be9d860a3a13a707c0d3a90f2d40f5a8c2749446b96ffeb471fa3913dd54b184a7d3e68a5803d77c246ed0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1672-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1672-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1672-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1672-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1672-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc62ce48b419162757eec4678c2f9852a053a473758c2009303621bf5e9adf41N.exe

C:\Users\Admin\AppData\Local\Temp\cc62ce48b419162757eec4678c2f9852a053a473758c2009303621bf5e9adf41N.exe
"C:\Users\Admin\AppData\Local\Temp\cc62ce48b419162757eec4678c2f9852a053a473758c2009303621bf5e9adf41N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-LhNQpC6GJnxY2H3n.exe

Filesize
83KB

MD5
1e75b803228c01df1286294c4ae5e685

SHA1
1b1d10816c4c2cd681b7e953529fce082dbafed9

SHA256
baa0c8d6b51b0c30e3aa56fa82295a41cacd4ee5b6975d85f2ed531c616aeba3

SHA512
9f35b79b8a94a7ce4da5d48e7bdb57a3f75bc518484a110c3dec7a22398e15362c887fff6cb65594b8d932614b02d879e5e0a6fe8c96b98465454cfa1063395d

Download Submit
memory/1672-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1672-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1672-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1672-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1672-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download