eabfc2ff87d0d94192ac1c596065fffc60c9bbcbf1968582cbb4f941a8637418

Analysis

max time kernel
111s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabfc2ff87d0d94192ac1c596065fffc60c9bbcbf1968582cbb4f941a8637418N.exe
Size

83KB
MD5

3427fdf7faac0aa6995e3ec427db4b80
SHA1

6f3ea355ae16a213db44827771238ed26b6f11bd
SHA256

eabfc2ff87d0d94192ac1c596065fffc60c9bbcbf1968582cbb4f941a8637418
SHA512

1b04486526c41e5e81111e3779c6325b778ad1ffffde727752cdd843f4aa0ea79563fdadbf34da91482f09d226772fead917862eb7fd9636b5e43f54d2c39124
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+GK:LJ0TAz6Mte4A+aaZx8EnCGVuG

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3176-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3176-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3176-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3176-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000c000000023ba8-12.dat	upx
behavioral2/memory/3176-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3176-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabfc2ff87d0d94192ac1c596065fffc60c9bbcbf1968582cbb4f941a8637418N.exe

C:\Users\Admin\AppData\Local\Temp\eabfc2ff87d0d94192ac1c596065fffc60c9bbcbf1968582cbb4f941a8637418N.exe
"C:\Users\Admin\AppData\Local\Temp\eabfc2ff87d0d94192ac1c596065fffc60c9bbcbf1968582cbb4f941a8637418N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-yLNSVHtHg0C6vL2T.exe

Filesize
83KB

MD5
1eedd6de4273a632ae5d3546668554d7

SHA1
0d683be31895279868489ddd927377513ab3babc

SHA256
65640f5d8525efa7b73062b681ce934cc5d6d48cec2cefab9bf703e92019e09f

SHA512
17236c5f4757e9ff50efa3a4c0f32f0d6b5e4cbd459cc73b937c00a3d2282f285d6679df7c270f41acb6eb9ab30564c6f0ae8eb5fc1f78cc861cfc3ad27de69f

Download Submit
memory/3176-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3176-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3176-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3176-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3176-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3176-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download