10814979b25bb10fe081e351c0bc79c1a81d1dc05aa3c39d6e136710f818b480

Analysis

max time kernel
110s
max time network
91s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10814979b25bb10fe081e351c0bc79c1a81d1dc05aa3c39d6e136710f818b480N.exe
Size

83KB
MD5

f1785fd3664d085ea6f33bddf7b303f0
SHA1

4fdc5b96227dd5b2d3487b1cda6eb343f8b06a8e
SHA256

10814979b25bb10fe081e351c0bc79c1a81d1dc05aa3c39d6e136710f818b480
SHA512

05eb6aa3f726ed5664c730e770a1a0f34bcfaaaca7f3ae1dd1ac70665a8a5af3a4ed23a205ebdae71eeed0d413248e0daac69cb00f001130e4bcb2b2999386ca
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1480-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1480-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1480-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1480-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1480-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10814979b25bb10fe081e351c0bc79c1a81d1dc05aa3c39d6e136710f818b480N.exe

C:\Users\Admin\AppData\Local\Temp\10814979b25bb10fe081e351c0bc79c1a81d1dc05aa3c39d6e136710f818b480N.exe
"C:\Users\Admin\AppData\Local\Temp\10814979b25bb10fe081e351c0bc79c1a81d1dc05aa3c39d6e136710f818b480N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-pYSom1Ix5xsmlG9u.exe

Filesize
83KB

MD5
e247012f245fe1a8530a8bb5739dc02f

SHA1
cf46e5bc1369102406a787c2153eb6b0527b688f

SHA256
f838829fc6b23121298c125b5ebeedeb08b00e50132202276b05395bee6494a5

SHA512
29c1a3827bf8b762c21dd0c20802a23225635a36d789216f53c82b5e21c69cfa6fe454fc5e918adb6d6a19b9c1ba0850ca99c314e809b781c019163579f8e585

Download Submit
memory/1480-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1480-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1480-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1480-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1480-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download