13fbd5764b70e8d74cb30ae6a986bf18e28bf72be986800302d922c3b2967eb6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13fbd5764b70e8d74cb30ae6a986bf18e28bf72be986800302d922c3b2967eb6N.exe
Size

83KB
MD5

6757725aa4e191924c4895e9f4cc8c40
SHA1

ea7320c6f0bde759f001d1fd1b755667cd542577
SHA256

13fbd5764b70e8d74cb30ae6a986bf18e28bf72be986800302d922c3b2967eb6
SHA512

cde76c616c185a490297db75873e9b450b2de7e071c5c2b9d2013aaf4fae276f3254ae7ce5df4f74cb60d6450ed40517d3b01e2d51cb6fe25263b2d4bb016bdf
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:LJ0TAz6Mte4A+aaZx8EnCGVuW

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2320-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2320-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2320-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2320-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13fbd5764b70e8d74cb30ae6a986bf18e28bf72be986800302d922c3b2967eb6N.exe

C:\Users\Admin\AppData\Local\Temp\13fbd5764b70e8d74cb30ae6a986bf18e28bf72be986800302d922c3b2967eb6N.exe
"C:\Users\Admin\AppData\Local\Temp\13fbd5764b70e8d74cb30ae6a986bf18e28bf72be986800302d922c3b2967eb6N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-WSGLH4wgLz4fQRYQ.exe

Filesize
83KB

MD5
e4655c8ab64a79a57885ab2ad804a8cd

SHA1
89b196d702c7e3f6e3dbb0159884a89a75821b31

SHA256
fa159296b537ea54bc7e7c75705fd3c1095494e582e86c177d1de60853b8e6ae

SHA512
2e0ee9ee74a3ce7f9d0b07ac6a23c8fe38a80d6b932be338ffb35c628b22e0257d3e43d9a32582b65e437e61da92f04e4749a67b59a95c8cb43f693c743d126a

Download Submit
memory/2320-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2320-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2320-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2320-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2320-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download