dc462297e8f33cce5516188237d8bfc0e67743e6c2eed530c9696ababe674b32

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc462297e8f33cce5516188237d8bfc0e67743e6c2eed530c9696ababe674b32N.exe
Size

83KB
MD5

c718973a1eee1b6f2c99cfff0fa52bc0
SHA1

fef22b6f817d80c024b7cf524b0252f35898a939
SHA256

dc462297e8f33cce5516188237d8bfc0e67743e6c2eed530c9696ababe674b32
SHA512

699430d4c6382dbf1e1ffb91e1f5419f0ffed65e78a624e72c28b2076437ff4ec71ec4de8a3c32e4e609350a0909e58ef801533cce4cc33c68df9378e5577587
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+BK:LJ0TAz6Mte4A+aaZx8EnCGVuB

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2828-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2828-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2828-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2828-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2828-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc462297e8f33cce5516188237d8bfc0e67743e6c2eed530c9696ababe674b32N.exe

C:\Users\Admin\AppData\Local\Temp\dc462297e8f33cce5516188237d8bfc0e67743e6c2eed530c9696ababe674b32N.exe
"C:\Users\Admin\AppData\Local\Temp\dc462297e8f33cce5516188237d8bfc0e67743e6c2eed530c9696ababe674b32N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-1iVHeos9GdXrQ7cT.exe

Filesize
83KB

MD5
c65d135df44355bf5e66695a84649a30

SHA1
8caf559da65cb0dfbaf83b868dd53c74ef30f113

SHA256
a6d5e6120f56e943105c9a8e52e3608ba551399afff5b8858c21f81087d0141a

SHA512
dc2a8d483cf00f759a406c9041c36dc1ee74e0d55a642a4223d673eb43444c3df6eb29ad6a18a64be1e0a8cfc1418716ea6265708c2ab0eddf0a6131ff622dac

Download Submit
memory/2828-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2828-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2828-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2828-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2828-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download