f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe
Size

236KB
MD5

1076e124fb71edfc03783ba4ed06a152
SHA1

11620958c9cc9e71718a452cd42339d9331d06a1
SHA256

f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca
SHA512

dbc348e39591d9db592122512101fdb24802eec0dfc8a754715491c2731b9f762041ba7d66d8e1ea45f07d0938d793eecea2f6b46f64c3bb6d7f2d77dd809df7
SSDEEP

3072:hJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/FnncroP9:rwDeM7iNEkgiOb31k1ECJJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2880-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe

C:\Users\Admin\AppData\Local\Temp\f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe
"C:\Users\Admin\AppData\Local\Temp\f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-zyMldm3RYKr6c5CR.exe

Filesize
236KB

MD5
7c482730e47ca355b85d11a50caf66bd

SHA1
7c799323ea1e90ce3b0dc9e0750813bd06017b9a

SHA256
9b0f6b7b4bcce49536c23def979736c39c4763d044cc76d7a95bb525c081b723

SHA512
e36150c5aa00be7027dd4646ea7e8df8f96ae57eebcd15f9847889c791efea8c7f3ebc7b2876e734463d5793d98572d52e59a4f75638233ff2fd11dc8ec8593b

Download Submit
memory/2880-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2880-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download