ee98eaf4817c70cfaec7111d9612de8273dd3efeb92840655cf460d803b66bbc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee98eaf4817c70cfaec7111d9612de8273dd3efeb92840655cf460d803b66bbcN.exe
Size

83KB
MD5

5c6339532ad36ec91b46a7b7d73d97a0
SHA1

11e21c30f74de1bc05b6f59e90733706d46c4dca
SHA256

ee98eaf4817c70cfaec7111d9612de8273dd3efeb92840655cf460d803b66bbc
SHA512

4a001382dd5b388fd39b90e3bcd8b86760f658d33aacbe0528fe46d3fe06075db9a3eccc6d9cb4edcdc42b2fb38ea95750264854180de73ec3915db067b4da49
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+FK:LJ0TAz6Mte4A+aaZx8EnCGVuF

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2200-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2200-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0016000000005587-11.dat	upx
behavioral1/memory/2200-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2200-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee98eaf4817c70cfaec7111d9612de8273dd3efeb92840655cf460d803b66bbcN.exe

C:\Users\Admin\AppData\Local\Temp\ee98eaf4817c70cfaec7111d9612de8273dd3efeb92840655cf460d803b66bbcN.exe
"C:\Users\Admin\AppData\Local\Temp\ee98eaf4817c70cfaec7111d9612de8273dd3efeb92840655cf460d803b66bbcN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-GbtWZUhqeRgDa80e.exe

Filesize
83KB

MD5
9cc720ab8b9b94176be0aaf67e9c9854

SHA1
1e56eb05bbe7d1e07dea4f871eb980a213758f80

SHA256
6ed6ff145be66fca82945b79a7eec8e496b8f64c8c0ef06aa134328903058055

SHA512
a5a0deae65b10747899b09e46f03310db3e37d729c41b18231f3c65067c8d028f58f006d28ffbd5ca88dee7f9b62d8b3e7251c736adbe77fc176279b442c4f8d

Download Submit
memory/2200-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2200-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2200-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2200-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2200-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download