9ca1f9e770eb1dacf5dbc32be6a7120902536eecab9d44f8d377e14a6dbe714a

Analysis

max time kernel
111s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ca1f9e770eb1dacf5dbc32be6a7120902536eecab9d44f8d377e14a6dbe714aN.exe
Size

83KB
MD5

d75789f595b5ed62fd5991c96785ca60
SHA1

3c9a941265d6112635096cedc551a5e712512697
SHA256

9ca1f9e770eb1dacf5dbc32be6a7120902536eecab9d44f8d377e14a6dbe714a
SHA512

a8fed527ee612d4a008f020667aac7aa0c3167488d55f37c95dc7151a9876c4bd7544210f617bc93551bfca7dfe8aab4a51e5c4c1b240115e18a908c66666677
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+UK:LJ0TAz6Mte4A+aaZx8EnCGVuU

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3108-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3108-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3108-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3108-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000c000000023b59-12.dat	upx
behavioral2/memory/3108-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3108-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ca1f9e770eb1dacf5dbc32be6a7120902536eecab9d44f8d377e14a6dbe714aN.exe

C:\Users\Admin\AppData\Local\Temp\9ca1f9e770eb1dacf5dbc32be6a7120902536eecab9d44f8d377e14a6dbe714aN.exe
"C:\Users\Admin\AppData\Local\Temp\9ca1f9e770eb1dacf5dbc32be6a7120902536eecab9d44f8d377e14a6dbe714aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-9hDjpmh7IwGXSV4e.exe

Filesize
83KB

MD5
e4ffc055dab2e45065132e73c5b087c5

SHA1
20d48ea8805fd7fc36f022adc6544f4f04840c2e

SHA256
bc0cf2a4f32252f13128036cd9e208fa842af82b94776e20b73ffa841549493d

SHA512
0f51a4962d422ad67fabec42f8e542e16f2015309252f50b72d7b4e2c221d0272d0b6a08cd98baf4cef7c5365640dd2f1c913dbfd14af58b3ad155407e9742c1

Download Submit
memory/3108-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3108-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3108-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3108-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3108-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3108-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download