6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524

Analysis

max time kernel
119s
max time network
93s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe
Size

236KB
MD5

ea9d8e9e0f532731adb78463d544cfc0
SHA1

d95f1a33049089aad30800b0809d5f5f48ec84e6
SHA256

6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524
SHA512

889897358d485f0fc3dceb041ca283b50e6ac78e590a63a8951921ebcf2f4ce3c37f0460b4356301193735fc59bb030fe127455aadc873ef463c7069d16f9d80
SSDEEP

3072:dJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/7/FnncroP9:HwDeM7iNEkgiOb31k1ECrJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/800-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/800-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe

C:\Users\Admin\AppData\Local\Temp\6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe
"C:\Users\Admin\AppData\Local\Temp\6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-99gOPvqFf5t1Jivb.exe

Filesize
236KB

MD5
c77cbfeee70919df52b950538da5914e

SHA1
aa9eff90c3bcc80ee27283940972bc1c422e7751

SHA256
32c0b4be75908b698f266c27781cdda0cd0cfecca7c982e9a105e68fa36c6a2e

SHA512
cfe4fefd87663919f687dedab2b8b7904ef6057f65f947a77f7c010c2f0e7c5c10dbd275742fd7f8dd23e2efb4f0a7a86fb0afd5609f8b370eff31d375f66cf3

Download Submit
memory/800-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/800-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download