838e8dd48072c1432237d082f40db6e52861243508c7d3f6be2feaa0349d390a

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

838e8dd48072c1432237d082f40db6e52861243508c7d3f6be2feaa0349d390aN.exe
Size

83KB
MD5

4252e45b46b1b9d0727c025db5f63120
SHA1

dcff43ca023955d31fa72daa73cb5d78cf57f05f
SHA256

838e8dd48072c1432237d082f40db6e52861243508c7d3f6be2feaa0349d390a
SHA512

fe8b01b87a6dbb530f6c4947161e16e0fd531f3b079c7c5c6d65ec1c6e5bf001f30ea53adeb397cbab449df761bb9a20774c6db7645d2ec63a93a6d2746cadae
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1744-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0036000000017530-11.dat	upx
behavioral1/memory/1744-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1744-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	838e8dd48072c1432237d082f40db6e52861243508c7d3f6be2feaa0349d390aN.exe

C:\Users\Admin\AppData\Local\Temp\838e8dd48072c1432237d082f40db6e52861243508c7d3f6be2feaa0349d390aN.exe
"C:\Users\Admin\AppData\Local\Temp\838e8dd48072c1432237d082f40db6e52861243508c7d3f6be2feaa0349d390aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-LeIpS7DA2QpEbGgw.exe

Filesize
83KB

MD5
298efe05bf1d20cad667baec4d496646

SHA1
ec3019c648fd57a9caa8557f2ca90b5bb79b521b

SHA256
4b45b96f8ff49fbd0b94b93f849dfe9c3727033c8f0eec310c47d70cef3fe19f

SHA512
2b851665ffb88996acb6498745c2d0bc6a129d88f298c328bdc4d1a295b3a1439079661d4a1c4359414958329acdfc8cb929dec42d774f22db41c739b8f1aa12

Download Submit
memory/1744-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1744-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1744-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1744-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download