0a2897f2c55ddfe2607dd71e47c07a46ddee6e255baf0ae0f61d826e3cefe34d

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a2897f2c55ddfe2607dd71e47c07a46ddee6e255baf0ae0f61d826e3cefe34d.exe
Size

83KB
MD5

44c90b6cfd2ecc2b9f0a9569342796ac
SHA1

076263ca7b0223a579a8705d1546303fbd232e17
SHA256

0a2897f2c55ddfe2607dd71e47c07a46ddee6e255baf0ae0f61d826e3cefe34d
SHA512

258adbb16b2db603f4c9f7f2d12e38eb7e624bd064b0edaa9474711bdc6de34cf7699eecbc495e82d7b395835de02aa427ae331a0eed71ff296feb4db0e2b8a3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+gK:LJ0TAz6Mte4A+aaZx8EnCGVug

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3492-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3492-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3492-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3492-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000c000000023b07-12.dat	upx
behavioral2/memory/3492-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3492-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3492-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a2897f2c55ddfe2607dd71e47c07a46ddee6e255baf0ae0f61d826e3cefe34d.exe

C:\Users\Admin\AppData\Local\Temp\0a2897f2c55ddfe2607dd71e47c07a46ddee6e255baf0ae0f61d826e3cefe34d.exe
"C:\Users\Admin\AppData\Local\Temp\0a2897f2c55ddfe2607dd71e47c07a46ddee6e255baf0ae0f61d826e3cefe34d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-dUHIoNRwcmBu9pI0.exe

Filesize
83KB

MD5
a2faf393ec34f43254325eb07108d588

SHA1
8916c06fc25aa93ee6137be0f73d62fe88bf3b4e

SHA256
96371eb7386c8e4dc845a87812588d2d35f46fadfde4d0934d41ee34c3b8afb6

SHA512
5c7d10d395206ef9c6049d01f3d8a5400d56762b15bb9f8eea309addd86915d09398c3d02c9a83da194caef1c2b07a8109e8cabb397704c9f9474bf25d083585

Download Submit
memory/3492-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3492-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3492-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3492-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3492-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3492-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3492-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download