ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe
Size

83KB
MD5

4cd25994201163f1f7edcb9587853940
SHA1

123860e93f7aa788b47bf9d514e2ade6b340e350
SHA256

ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798
SHA512

03d49463c77dbcb787d3a4a5d8ac37cfd7677759763cd80ea6c29e74ca2db5945745096bb79e482d49e2cda00b8e47595e387be53f97c97d1d60d0b5e1652766
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+HK:LJ0TAz6Mte4A+aaZx8EnCGVuH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2312-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2312-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000f00000001226d-12.dat	upx
behavioral1/memory/2312-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2312-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe

C:\Users\Admin\AppData\Local\Temp\ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe
"C:\Users\Admin\AppData\Local\Temp\ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-lHaRiNoiD3Cc0jRE.exe

Filesize
83KB

MD5
f93bfa13c8c9a3fabac25d4d96483904

SHA1
76a03d8bdb1d3008e62f34c04e6a9ffd2138e9af

SHA256
cd38f7f134ab94a18cad02ce82272c675158a6be5a945455dd76fb3770f5b456

SHA512
7c606729cb3ebf9e6e273fd672430af2bbd1243312ea6ef419e3dc186db8e03dc1a1167d6ce86f32c2a671ebf1021a54b80709a1068633631407dc19e3551f03

Download Submit
memory/2312-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2312-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2312-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2312-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2312-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download