5c4312b27598ee3e8650b79ce71ca7dce3effcd5210a3b42b8b09cfe1d28adb9

Analysis

max time kernel
111s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c4312b27598ee3e8650b79ce71ca7dce3effcd5210a3b42b8b09cfe1d28adb9N.exe
Size

83KB
MD5

f670c4b165bab90a34e3490747bee8d0
SHA1

fea5de1e4a1f6b8f53035765da23022dbde07efe
SHA256

5c4312b27598ee3e8650b79ce71ca7dce3effcd5210a3b42b8b09cfe1d28adb9
SHA512

3227c8507719447e1ae2bac8242539c542d618ae78833039ec9302509a9399257c9550fbef8da366ccaa45429fad0c7054048d143c3e01b1653be3313848d69a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bK:LJ0TAz6Mte4A+aaZx8EnCGVub

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1068-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0010000000023b7c-11.dat	upx
behavioral2/memory/1068-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-19-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c4312b27598ee3e8650b79ce71ca7dce3effcd5210a3b42b8b09cfe1d28adb9N.exe

C:\Users\Admin\AppData\Local\Temp\5c4312b27598ee3e8650b79ce71ca7dce3effcd5210a3b42b8b09cfe1d28adb9N.exe
"C:\Users\Admin\AppData\Local\Temp\5c4312b27598ee3e8650b79ce71ca7dce3effcd5210a3b42b8b09cfe1d28adb9N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-iHWUePYSWrdCpMNw.exe

Filesize
83KB

MD5
d0a18a6c9a3f87c7fa6da3db96482225

SHA1
99de65e18ea1330b61481c6117dded348c126bda

SHA256
a40163e559893f46d7d2a5f8a19192b5d0e1792448d499e9f9ab1d3e54f967f3

SHA512
88fef0ef50cf28304036cf59189b5787574169383c4a9584d0b8be2bbf129de1e394bb012a2eec5b5d9ef4a229020a598c6e6fd5853c46c890b193a606890ce4

Download Submit
memory/1068-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download