17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae

Analysis

max time kernel
140s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe
Size

83KB
MD5

4dcc43e1de59ddffe86822527723e5f2
SHA1

c183d1a63681cb0facbe1ba9d15eb71bd09c1948
SHA256

17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae
SHA512

be581c1a45b18d69b893b7cc57395f406978f05e35db37c913bc8caec1bbdf589193b1b49784286f1c9f625ed5bd69c4c36e5ee1e279f73b8e2b5466efd7ae8b
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+nK:LJ0TAz6Mte4A+aaZx8EnCGVun

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2908-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2908-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2908-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2908-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2908-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0012000000023b01-12.dat	upx
behavioral2/memory/2908-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2908-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2908-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe

C:\Users\Admin\AppData\Local\Temp\17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe
"C:\Users\Admin\AppData\Local\Temp\17ba0a61f811e81522503512428e2e09c43116b2242b35dc26c468a36b216aae.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-iw48HvTuzO5oaX9d.exe

Filesize
83KB

MD5
df7f5ec816b7066c207d75d919bc3e3f

SHA1
89aa67c8c2fd1cd78140a9c3edf17d432735df4a

SHA256
6ec3ef8fa634e48756d240989b54965bce09edc4d4b5c3c8c001abea3f2cbdd5

SHA512
c48ed038ca318e91e4cf4605df9b65ae942834288da08dd14f801fefcd36cbde599122b8ca36c8a6f439488c91c435c8b732794d8310a8e4d317b3015753cd41

Download Submit
memory/2908-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2908-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2908-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2908-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2908-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2908-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2908-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2908-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download