1f5462322f391d9342c582b16e883779c7a755f82e7b0439d1043d3f87d23154

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f5462322f391d9342c582b16e883779c7a755f82e7b0439d1043d3f87d23154N.exe
Size

83KB
MD5

b3c99d9e51e63d6171de5ad621848670
SHA1

b996b349fd9b5be8554609a122b71f4f4e6c2b95
SHA256

1f5462322f391d9342c582b16e883779c7a755f82e7b0439d1043d3f87d23154
SHA512

8b6e31b25002752c54748783621cd611acf976b3e2a0b3b786a3226a8c6eb594a0a2c4a9a4b6d510cb502b6890ee6fbb89f7e350309e3072f6c47877c0d677ad
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1740-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1740-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1740-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1740-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f5462322f391d9342c582b16e883779c7a755f82e7b0439d1043d3f87d23154N.exe

C:\Users\Admin\AppData\Local\Temp\1f5462322f391d9342c582b16e883779c7a755f82e7b0439d1043d3f87d23154N.exe
"C:\Users\Admin\AppData\Local\Temp\1f5462322f391d9342c582b16e883779c7a755f82e7b0439d1043d3f87d23154N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-kBmfGf3fXLK8sz56.exe

Filesize
83KB

MD5
80f2cf234366bb6af1c514e130a5287e

SHA1
de295dc972662fba6eecb5abc88c71785688f0dc

SHA256
21835f4e1dde5e8c0cc5f2f66c12fc144012cffa7966852fe60172f09a8ea3cf

SHA512
f7fe7b85ce5d884b849d25a96f932e0fbd0191d6e5cc6bb352ed6b77a281a466717db42590d582aee15545ee062056732a258fa41ff023546ef29f913175fde2

Download Submit
memory/1740-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download