17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe
Size

83KB
MD5

4dcc43e1de59ddffe86822527723e5f2
SHA1

c183d1a63681cb0facbe1ba9d15eb71bd09c1948
SHA256

17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae
SHA512

be581c1a45b18d69b893b7cc57395f406978f05e35db37c913bc8caec1bbdf589193b1b49784286f1c9f625ed5bd69c4c36e5ee1e279f73b8e2b5466efd7ae8b
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+nK:LJ0TAz6Mte4A+aaZx8EnCGVun

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2672-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2672-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2672-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2672-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2672-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe

C:\Users\Admin\AppData\Local\Temp\17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe
"C:\Users\Admin\AppData\Local\Temp\17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-fFQ7k420913l7dWq.exe

Filesize
83KB

MD5
8fef95249659d60449d486301c6f0378

SHA1
1000cce3bae79cdd9a1b2286c891b12712701807

SHA256
84e19eac44e38b79311adfb13a1b75fb3d26c18fcea041e2742c2c4c61cf4233

SHA512
ac73e88c54c713917ca92fe61cc063b83da97808acce12c031fba70849c4d943110584e86d9a5f3f89f166c4c276c6de49f2090446f6a7fb9639ead33bc72396

Download Submit
memory/2672-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download