0274ad4d8c8d710790a7650a70322184594cf0fdd645d3ae6c8e2653ce35d65c

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0274ad4d8c8d710790a7650a70322184594cf0fdd645d3ae6c8e2653ce35d65c.exe
Size

83KB
MD5

1d909f1e6e89624caf680f20e9633066
SHA1

10ef5b6a57fedeeab35076ec1086ac7f08f01881
SHA256

0274ad4d8c8d710790a7650a70322184594cf0fdd645d3ae6c8e2653ce35d65c
SHA512

67ed8198e8342362603ad1474ebfdfefbd51f81c13d8d9299789f29b3efc53cc781f745eef41aafc0ca49729bff236ba35e0eb15d9e1de57574be63a5c4ea8dc
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+GK:LJ0TAz6Mte4A+aaZx8EnCGVuG

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2444-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2444-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2444-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2444-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00120000000239d2-11.dat	upx
behavioral2/memory/2444-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2444-18-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2444-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2444-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0274ad4d8c8d710790a7650a70322184594cf0fdd645d3ae6c8e2653ce35d65c.exe

C:\Users\Admin\AppData\Local\Temp\0274ad4d8c8d710790a7650a70322184594cf0fdd645d3ae6c8e2653ce35d65c.exe
"C:\Users\Admin\AppData\Local\Temp\0274ad4d8c8d710790a7650a70322184594cf0fdd645d3ae6c8e2653ce35d65c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-tUPPXegsE8hQeqaO.exe

Filesize
83KB

MD5
04994933cbaea15cf2315df2dc994549

SHA1
0e558b2aa05ba2a9445eec884dffa364b139bbfc

SHA256
57ba78aec05c3c6912f266021c66d0175cd2d44e6e6c080e95746ceb5776bb2d

SHA512
5df3bdec4245df41446f4c19d108b3afff57f08ae33cca55a62b8ffb9f83bffefdb19ae88eb28c1b10b363b171611e9265f113acf97e8c220b20317b369a07af

Download Submit
memory/2444-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2444-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2444-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2444-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2444-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2444-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2444-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2444-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download