3239184b22328ecbd0ca7eb222c1da0b494e3dd34d855a7047343f98b5362186

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3239184b22328ecbd0ca7eb222c1da0b494e3dd34d855a7047343f98b5362186N.exe
Size

83KB
MD5

4d1f1e2e11e76835429699582401a4d0
SHA1

52705ac1bd9a1909d3be9171d8b6bdcb6646bf7f
SHA256

3239184b22328ecbd0ca7eb222c1da0b494e3dd34d855a7047343f98b5362186
SHA512

32d3faa0ffd647137cee242e8a1092418f0c613c9b19da56cf3d84094a74b35a2fa5bbaaec4e386e10d5c9561be5dd0232a72325a698796e5b2b2cfcb9ce236d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2144-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2144-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2144-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000d000000012268-11.dat	upx
behavioral1/memory/2144-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2144-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3239184b22328ecbd0ca7eb222c1da0b494e3dd34d855a7047343f98b5362186N.exe

C:\Users\Admin\AppData\Local\Temp\3239184b22328ecbd0ca7eb222c1da0b494e3dd34d855a7047343f98b5362186N.exe
"C:\Users\Admin\AppData\Local\Temp\3239184b22328ecbd0ca7eb222c1da0b494e3dd34d855a7047343f98b5362186N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-dkhsreifVG3glwy0.exe

Filesize
83KB

MD5
0c5d05ae7bbee0cb40fa239e9c94ecac

SHA1
8451f75da8b29c25663e4a58844d6d35bd8d92d0

SHA256
0866ecf40b61efe625fa52aad194e27635ef02a81be0ddc047df7b7aba7879e7

SHA512
a4a4b82f995bdea0801da2e9262f5e8f11136235836ce2df65ef7e768262d1f94ac1f0b57a9389a41ac4944250dcb700ed3a6985236f8f205351a0c48b1130f4

Download Submit
memory/2144-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2144-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2144-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2144-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2144-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download