5dff7440c1d483c3753d76a5da8666537ed0d6837d13008f4274d3499332958c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dff7440c1d483c3753d76a5da8666537ed0d6837d13008f4274d3499332958cN.exe
Size

83KB
MD5

9d2e4b55a25973955344a67a196ea900
SHA1

8390f639b71f35df269c7a766719ace0e1c6c54d
SHA256

5dff7440c1d483c3753d76a5da8666537ed0d6837d13008f4274d3499332958c
SHA512

09bf3a9808a1bbc32aa31d9a4f34913b25a853db072948eded3793f8885fe588b0521bd692911c11647df04860528b779d9dcf9df456537652c7692655b8218c
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+kK:LJ0TAz6Mte4A+aaZx8EnCGVuk

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2052-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2052-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2052-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2052-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2052-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5dff7440c1d483c3753d76a5da8666537ed0d6837d13008f4274d3499332958cN.exe

C:\Users\Admin\AppData\Local\Temp\5dff7440c1d483c3753d76a5da8666537ed0d6837d13008f4274d3499332958cN.exe
"C:\Users\Admin\AppData\Local\Temp\5dff7440c1d483c3753d76a5da8666537ed0d6837d13008f4274d3499332958cN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Aplsws3ODRAj1NOr.exe

Filesize
83KB

MD5
cf89f0799faa5e19c12605b837020e09

SHA1
fe1f4634017a85a5663524fab9b6ab3c05a267fb

SHA256
4e858309e0f5cdb791b296d9ee16e6f611056de66ec5cd3305e740f4013b4526

SHA512
280a5337d5cc55b5f2d3081ea32436824faa3cbbeb1b0dbd5d0bb306927147fa883aebae2bae4c00d2ae7bea2ca9064ccd88ad60248b78addfbca7dff505758e

Download Submit
memory/2052-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2052-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2052-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2052-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2052-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download