370ee336b09824907fb0803855effb92fbaf19c6c1452af71f0477ef39fa7aa3

Analysis

max time kernel
110s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

370ee336b09824907fb0803855effb92fbaf19c6c1452af71f0477ef39fa7aa3N.exe
Size

83KB
MD5

b84e8b8aed99f7e75c22c9a1b4af0520
SHA1

d1cf0b6880203df856c24e32335a6b11cd8d360a
SHA256

370ee336b09824907fb0803855effb92fbaf19c6c1452af71f0477ef39fa7aa3
SHA512

16f1ad95b1cf6bf265a000eb14dc49d250d54ce8792b3b9f69fb691352c531aada6a5ebf64b4919611c7c8bb643fa05e2bbc18a31cc4ca4c654b53f2d6681449
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2640-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2640-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2640-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000d000000023ae2-11.dat	upx
behavioral2/memory/2640-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2640-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	370ee336b09824907fb0803855effb92fbaf19c6c1452af71f0477ef39fa7aa3N.exe

C:\Users\Admin\AppData\Local\Temp\370ee336b09824907fb0803855effb92fbaf19c6c1452af71f0477ef39fa7aa3N.exe
"C:\Users\Admin\AppData\Local\Temp\370ee336b09824907fb0803855effb92fbaf19c6c1452af71f0477ef39fa7aa3N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-3i2u9r55VpxWe4uI.exe

Filesize
83KB

MD5
e166b210f7eddb8e142396863758f54b

SHA1
791bf78da5935ae7998ce19d44c6d9d676f6da28

SHA256
38b1b1e2858a8842da9e767de2084bce10d01f7bca5207ffb828561b414656c4

SHA512
74e4e47f052bfdaaee0dfe6d953d4696d6c5c3248f071e22113e884734aa5f29617d398db78d597c8792f718325207e0c08525aa9a637558df3763e47b981315

Download Submit
memory/2640-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download