e9a616e0522ae26a4307087fff45a82a550cd6c1aab0896aa60a64e2023dfabf

Analysis

max time kernel
111s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9a616e0522ae26a4307087fff45a82a550cd6c1aab0896aa60a64e2023dfabfN.exe
Size

83KB
MD5

ee29837982e391ee2ee87ce45d118060
SHA1

408a396d17e5e38e11f8f66098a32468d04c3fd9
SHA256

e9a616e0522ae26a4307087fff45a82a550cd6c1aab0896aa60a64e2023dfabf
SHA512

e05ed7d1c5b1ceb6c2a50b594b619cde016606c83a7906b2d305709fd32dd9e53f062ec67770fdb74593899862736e2546680a2aa6c6551bfe4b21f1a56903ef
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+9K:LJ0TAz6Mte4A+aaZx8EnCGVu9

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1732-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1732-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1732-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1732-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000c000000023b34-11.dat	upx
behavioral2/memory/1732-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1732-19-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9a616e0522ae26a4307087fff45a82a550cd6c1aab0896aa60a64e2023dfabfN.exe

C:\Users\Admin\AppData\Local\Temp\e9a616e0522ae26a4307087fff45a82a550cd6c1aab0896aa60a64e2023dfabfN.exe
"C:\Users\Admin\AppData\Local\Temp\e9a616e0522ae26a4307087fff45a82a550cd6c1aab0896aa60a64e2023dfabfN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-UX2uAHQ7Oin4PO78.exe

Filesize
83KB

MD5
fde71e94b3b98d005b9bb3e2f7a12c3e

SHA1
6050a83777cf702763ee487c5a97444244d823fd

SHA256
e3d02303d6aa3fb6776125bfd86806c5ec143815e18115e19c9a92bf6e0ea3b9

SHA512
a945785eff19216884ff0baa882da3519ba58385371b42d42d7781db795cd60c9efa08bc73bb07c1dbe682c9a8098c25db9d634da44eeade590fcca658dfa8c2

Download Submit
memory/1732-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download