78fa09cbe07c671d09c59d639079d1500e65843015ca6e63db7ddee1f66514d5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78fa09cbe07c671d09c59d639079d1500e65843015ca6e63db7ddee1f66514d5N.exe
Size

83KB
MD5

e9892a77ffe4b9ea1e0e4e4966f8f4d0
SHA1

82b1377658e6b27b62046754a98a0d0f139c3749
SHA256

78fa09cbe07c671d09c59d639079d1500e65843015ca6e63db7ddee1f66514d5
SHA512

f0e7321e0eefc9d651461e39ec5f8a47a099d9e605e734057cf418d21361e349bf1f504f12ffd9743c1620db31bba7318bb679fe6e4b2479895a3a050b57b871
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+tK:LJ0TAz6Mte4A+aaZx8EnCGVut

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2540-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2540-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000e000000012266-11.dat	upx
behavioral1/memory/2540-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2540-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78fa09cbe07c671d09c59d639079d1500e65843015ca6e63db7ddee1f66514d5N.exe

C:\Users\Admin\AppData\Local\Temp\78fa09cbe07c671d09c59d639079d1500e65843015ca6e63db7ddee1f66514d5N.exe
"C:\Users\Admin\AppData\Local\Temp\78fa09cbe07c671d09c59d639079d1500e65843015ca6e63db7ddee1f66514d5N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-6BcOBoO74jHNALjg.exe

Filesize
83KB

MD5
6d3e23e0a315201775538ae181b783c4

SHA1
3d313aba7cb853e5667a8e8a4c96e08ac4122080

SHA256
f1d1b85acf3733eb2d04257906d8c99ad26cd84335f10f85539192d65dfa47fd

SHA512
627fa630b59487d18c73aff54ad3759fc926846528613d6d36cd4d416c809cb07a8f0a43269d4cb21ec681a2172f054a50ef4b030e6d5f11a4b4aee26b066973

Download Submit
memory/2540-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2540-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2540-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2540-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download