bcd737179b765de15423a7d9614584bf0b2443bae52ac2994674353e74cf4c0c

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bcd737179b765de15423a7d9614584bf0b2443bae52ac2994674353e74cf4c0cN.exe
Size

83KB
MD5

05d8154e93c613b917b153eb5becbec0
SHA1

94df35560e688702c89d6174110bece415c6cf8d
SHA256

bcd737179b765de15423a7d9614584bf0b2443bae52ac2994674353e74cf4c0c
SHA512

abd8cea443b1a40ea656b7438918cfb941b3ea89dae5198ff4e8dd787a6c1eda6c6982af8115f96ab49a23ded1e43bd92c8539eba49c84317b14d6082215b7a3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+EK:LJ0TAz6Mte4A+aaZx8EnCGVuE

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/876-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/876-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/876-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/876-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/876-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcd737179b765de15423a7d9614584bf0b2443bae52ac2994674353e74cf4c0cN.exe

C:\Users\Admin\AppData\Local\Temp\bcd737179b765de15423a7d9614584bf0b2443bae52ac2994674353e74cf4c0cN.exe
"C:\Users\Admin\AppData\Local\Temp\bcd737179b765de15423a7d9614584bf0b2443bae52ac2994674353e74cf4c0cN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-HWt6dFCPEXPDMbRG.exe

Filesize
83KB

MD5
5605cd6068db099c48de866cc8f7142a

SHA1
4eeffda387426b9b97591a5cf7bdfd6fc2527424

SHA256
60fbe402d81f8c80c679528d4eb9ab2d4160dd903ac56c66ac56ae44333734e0

SHA512
631e4e97a30ef5169691e7827b85714c66b4ad1834b1f61fa9f7e86b128431c83c87d1c4bc4fe5e2911bb6ac5c032fae769b18f6c40bee359cfbed39308a870f

Download Submit
memory/876-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/876-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/876-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/876-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/876-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download