f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2

Analysis

max time kernel
110s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe
Size

83KB
MD5

0dc297e665dc28b4b37a4d20c1e3b9f0
SHA1

6001cfdecd8e4ad5fdaa0c1bb5565cf3b11e0503
SHA256

f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2
SHA512

23a644c7a6d58d4a943dc5d0ed9bf89f9a0bad3dd28f0aa1e5efd55204613fda19ae81b19f09589ee5b34698794a349bd166064e252d85358f1e56ff4a76ffc4
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+qK:LJ0TAz6Mte4A+aaZx8EnCGVuq

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2512-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2512-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2512-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2512-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2512-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe

C:\Users\Admin\AppData\Local\Temp\f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe
"C:\Users\Admin\AppData\Local\Temp\f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-KgBc54cnddASejPt.exe

Filesize
83KB

MD5
b71b82d790c4442e7b53333c1e94faee

SHA1
110140335d7336cb00ba2ccfff147aedc8161a77

SHA256
ef9e6379d50a4f6814413a40892121537185a99fdc70b8de755682ba6cb75b3c

SHA512
2b47e5db660594404ebd20eb49f2fd4c61b68c315c3103b2ac88829d0905bc91a986ee943bb8d52aa3eb3527e656f6d06fd8392b41c67d80c71b43464491a53c

Download Submit
memory/2512-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2512-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2512-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2512-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2512-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download