9ef422ea1b964d6b73e7ebd7ab5efde0829c39bb7c5eff5a04240e5fead05345

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ef422ea1b964d6b73e7ebd7ab5efde0829c39bb7c5eff5a04240e5fead05345N.exe
Size

83KB
MD5

27c9047c6b7e9be6219fdaa3cc5d63c0
SHA1

9f41f481e8cca0aa1b3f85ee3d7813f7b5b9006c
SHA256

9ef422ea1b964d6b73e7ebd7ab5efde0829c39bb7c5eff5a04240e5fead05345
SHA512

5de4860230060747379f41bd7b5d55d46720f733fc37693bb0b0318aae99cf46670e622466e216098136ba2dbfe37c8f71868a55500f010284e52b3fa2ee46e3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF++K:LJ0TAz6Mte4A+aaZx8EnCGVu+

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1676-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1676-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1676-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1676-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1676-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ef422ea1b964d6b73e7ebd7ab5efde0829c39bb7c5eff5a04240e5fead05345N.exe

C:\Users\Admin\AppData\Local\Temp\9ef422ea1b964d6b73e7ebd7ab5efde0829c39bb7c5eff5a04240e5fead05345N.exe
"C:\Users\Admin\AppData\Local\Temp\9ef422ea1b964d6b73e7ebd7ab5efde0829c39bb7c5eff5a04240e5fead05345N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-JuQRUAcA8vrho6ma.exe

Filesize
83KB

MD5
ae881ef751a38be418aaf043d0c927a4

SHA1
66509fa28d78ed46f20a6965da0936157714f45d

SHA256
ddb761e8a37db9926349217bf6f57b16588df6c71da6974b4b6cd9dc8b389895

SHA512
f03e004300828a18f3b7dc8bdbbc7cba4b3d0346b7da2d72afa5eb8e78dbaf33ca19bb202387d91f7f842932af008f10747d91c66f5389994ba2fa8f11a340b3

Download Submit
memory/1676-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download