f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe
Size

236KB
MD5

1076e124fb71edfc03783ba4ed06a152
SHA1

11620958c9cc9e71718a452cd42339d9331d06a1
SHA256

f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca
SHA512

dbc348e39591d9db592122512101fdb24802eec0dfc8a754715491c2731b9f762041ba7d66d8e1ea45f07d0938d793eecea2f6b46f64c3bb6d7f2d77dd809df7
SSDEEP

3072:hJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/FnncroP9:rwDeM7iNEkgiOb31k1ECJJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1364-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1364-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000b000000023b84-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe

C:\Users\Admin\AppData\Local\Temp\f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe
"C:\Users\Admin\AppData\Local\Temp\f94a0d23bf5d73a8f143f5f8aa5518dadb63390290bfbbdaecac49b0413031ca.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-g8QKBvilXClpsArJ.exe

Filesize
236KB

MD5
ab8834f8fe67645c96618aad65681089

SHA1
51df36589e78f7c29798ac63d05ec8651e005348

SHA256
e171adbe5069b32883a0623e2de571a0b76b3cb19fdabe5cfbcd2c5e284208e3

SHA512
fbab74b9c117554eaf71342769098b0415fd3ed061283bdfd95a4aaf9a2e3e017c31abc35a4242cb6f59fcf1f548bf76ad5a256b411d7e14c47d2c8b04c3d12a

Download Submit
memory/1364-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1364-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download