6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524

Analysis

max time kernel
106s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe
Size

236KB
MD5

ea9d8e9e0f532731adb78463d544cfc0
SHA1

d95f1a33049089aad30800b0809d5f5f48ec84e6
SHA256

6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524
SHA512

889897358d485f0fc3dceb041ca283b50e6ac78e590a63a8951921ebcf2f4ce3c37f0460b4356301193735fc59bb030fe127455aadc873ef463c7069d16f9d80
SSDEEP

3072:dJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/7/FnncroP9:HwDeM7iNEkgiOb31k1ECrJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2268-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2268-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000b000000023b7e-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe

C:\Users\Admin\AppData\Local\Temp\6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe
"C:\Users\Admin\AppData\Local\Temp\6d465a3a21852653d7319f557abd7a8b3d553f9d45edc8dcbddcc2aac627e524N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-t1W6YNJjG3sli3h1.exe

Filesize
236KB

MD5
b96a78d12b0dbb8ab97311608096c41e

SHA1
89eefb1e2e67fa6c8fe1bb256d4235aed168ff0e

SHA256
96d72d432dc73435268045d0d44038c09776097e2ad937a09fd87ae0f02255dd

SHA512
930c16376c29c082ca0c7cd49ccda738b0fa87cf3a49ec06ea0b0e24dde2ddfee1e1b2d3548a741b6a613a0d851f5ef0d1e3b5d5dfb199616be62b0f422c29ca

Download Submit
memory/2268-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2268-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download