0247b735c1d2706ec2ede2389f9b46b046d79d40dc01776d73084e2a0355c257

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0247b735c1d2706ec2ede2389f9b46b046d79d40dc01776d73084e2a0355c257N.exe
Size

83KB
MD5

a7ba73b04a1246f0e1a09cfc032d1580
SHA1

a351646e2bdabd44181e73f2d8916d8f215d9308
SHA256

0247b735c1d2706ec2ede2389f9b46b046d79d40dc01776d73084e2a0355c257
SHA512

bee038c570ce52f68820ca334bf6443f6678b2864e5675e64caaa74b015dfd0a3d69bc7b1ba8e6782a9cc96f185098a6760fc325805f18abd897421726ddf2a0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1664-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1664-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1664-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1664-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0247b735c1d2706ec2ede2389f9b46b046d79d40dc01776d73084e2a0355c257N.exe

C:\Users\Admin\AppData\Local\Temp\0247b735c1d2706ec2ede2389f9b46b046d79d40dc01776d73084e2a0355c257N.exe
"C:\Users\Admin\AppData\Local\Temp\0247b735c1d2706ec2ede2389f9b46b046d79d40dc01776d73084e2a0355c257N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-0Ju2iX9uILG36zkS.exe

Filesize
83KB

MD5
fb9d65eca1c6b3315e492c4ddf91f59d

SHA1
a1a7c36b89412212b4537504940f7b1cb66cbcac

SHA256
cb1c4c8884fbb9e978e56d4578f700ad56203f76476287f5b13863e582a22bdb

SHA512
09d6ee56bff71eadb2bc7cc3fe661191714db9521585aa79f800b0080df833832ab7ec409aaad2518fc2394fc229bafdc3bf4d2c355c178a7fed3c99b3927489

Download Submit
memory/1664-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1664-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1664-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1664-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1664-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download