ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798

Analysis

max time kernel
110s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe
Size

83KB
MD5

4cd25994201163f1f7edcb9587853940
SHA1

123860e93f7aa788b47bf9d514e2ade6b340e350
SHA256

ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798
SHA512

03d49463c77dbcb787d3a4a5d8ac37cfd7677759763cd80ea6c29e74ca2db5945745096bb79e482d49e2cda00b8e47595e387be53f97c97d1d60d0b5e1652766
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+HK:LJ0TAz6Mte4A+aaZx8EnCGVuH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1616-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1616-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1616-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0042000000023487-11.dat	upx
behavioral2/memory/1616-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1616-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe

C:\Users\Admin\AppData\Local\Temp\ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe
"C:\Users\Admin\AppData\Local\Temp\ba024909b55d43fbc25f854436840f97a04da139c0ecd8cb7f0ceef536ded798N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-ZqDf3feCQVSSDhJh.exe

Filesize
83KB

MD5
8c0c58b354f695c4f7b5d220eae9c42f

SHA1
911258cfe87d8b095a595b42a95c1fc263bd4c6c

SHA256
7b82bc54ec20549abbdf0c21756ed44d3c7ae2266cec8a7d582ea12d6b0f90c7

SHA512
826cd98bdaf8e707dc1603a152d3b187f99430ac70c0916b3c757c14e720573576be5a9395a1744b97e35bd4c2e8a3a99b71b6d7243a7c0d94e2df6f4d83f932

Download Submit
memory/1616-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1616-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1616-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1616-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1616-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download