f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2

Analysis

max time kernel
111s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe
Size

83KB
MD5

0dc297e665dc28b4b37a4d20c1e3b9f0
SHA1

6001cfdecd8e4ad5fdaa0c1bb5565cf3b11e0503
SHA256

f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2
SHA512

23a644c7a6d58d4a943dc5d0ed9bf89f9a0bad3dd28f0aa1e5efd55204613fda19ae81b19f09589ee5b34698794a349bd166064e252d85358f1e56ff4a76ffc4
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+qK:LJ0TAz6Mte4A+aaZx8EnCGVuq

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3612-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3612-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3612-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3612-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000c000000023ba9-12.dat	upx
behavioral2/memory/3612-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3612-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe

C:\Users\Admin\AppData\Local\Temp\f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe
"C:\Users\Admin\AppData\Local\Temp\f2043ca1762eb050d0b01b909fb8650cc93cec491e332564bf3a4c3e59223ec2N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-cvGZE43Rta3vb5iC.exe

Filesize
83KB

MD5
010841ce82889976f5258b370e87c361

SHA1
d847decd202d8e49f5f6a80c6b83142c62c7c66d

SHA256
0590107941d690f3aaf933c6df26199593f61f20d6aad82362c9f2e6552b4ed7

SHA512
0fcb422a80550488d3b6ba1c820c7dce46ec9f6aef206fdfe56bd763611edeacc597bcccb3d3983443d59b3738b57db4132cbc9238afd34c44602a5f0f11f181

Download Submit
memory/3612-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3612-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3612-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3612-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3612-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3612-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download