a7dfeaba531b7966bbe6ae98bb6419c5e53da1a5d1c2d9e87ecb7721e8661216

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7dfeaba531b7966bbe6ae98bb6419c5e53da1a5d1c2d9e87ecb7721e8661216N.exe
Size

83KB
MD5

c88bfaef69fc640387fda0c049b87ad0
SHA1

30dfff1970bb51ce17e4484566bf58c5b6ae34b2
SHA256

a7dfeaba531b7966bbe6ae98bb6419c5e53da1a5d1c2d9e87ecb7721e8661216
SHA512

46eb391f57d6d6764c65d2e9bed43b71cc55261130e8c2bae6fce52641713cbea7ef0c8ffbf4966b790caf6d64f38248ee837b914cbf8c3a14a879bee8ee5fe4
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+UK:LJ0TAz6Mte4A+aaZx8EnCGVuU

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2968-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2968-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2968-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2968-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7dfeaba531b7966bbe6ae98bb6419c5e53da1a5d1c2d9e87ecb7721e8661216N.exe

C:\Users\Admin\AppData\Local\Temp\a7dfeaba531b7966bbe6ae98bb6419c5e53da1a5d1c2d9e87ecb7721e8661216N.exe
"C:\Users\Admin\AppData\Local\Temp\a7dfeaba531b7966bbe6ae98bb6419c5e53da1a5d1c2d9e87ecb7721e8661216N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-lrTrgC8RLojOMsEH.exe

Filesize
83KB

MD5
8b98cbb834b6033773823a277e125439

SHA1
33a46df3df95e9e47a63e1e124d9ac22afd7da2a

SHA256
5b78580bce1723fb3767ef30de2047eb250c879c73ab6c0ef99cef3be365016d

SHA512
c33ee269b706ea6421d32069c5541824bc3b07d6600a1b1dd303de4b3f53e005acc085ae5a70e75803b431d3a335a819022a25f804e1588ad1f8535de24462c2

Download Submit
memory/2968-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2968-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2968-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2968-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2968-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download