380b950a6797754cda063061782b5b81a0a0f9dbd763b49590b35d920a60eea8

Analysis

max time kernel
95s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
380b950a6797754cda063061782b5b81a0a0f9dbd763b49590b35d920a60eea8N.exe
Size 236KB
Sample241107-scd1csvaqq
SHA256 380b950a6797754cda063061782b5b81a0a0f9dbd763b49590b35d920a60eea8
MD5 ed7232bbf68854f5380a5d6bcb7cc810
SHA1 b2df30fb09f4c4c58026cef134519207425437e9
SHA512 d48c792229cbb390b5b7e8604edd19e7072caee3daea13701023c0baf2867630bc72abb39390b51872cdb9ac0031b730853f8a2f12e70778e2dbec119ebe1aed
SSDEEP 3072:6J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/e/FnncroP9:OwDeM7iNEkgiOb31k1ECgJ/F
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1320-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1320-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0008000000023cb4-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	380b950a6797754cda063061782b5b81a0a0f9dbd763b49590b35d920a60eea8N.exe

C:\Users\Admin\AppData\Local\Temp\380b950a6797754cda063061782b5b81a0a0f9dbd763b49590b35d920a60eea8N.exe
"C:\Users\Admin\AppData\Local\Temp\380b950a6797754cda063061782b5b81a0a0f9dbd763b49590b35d920a60eea8N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-6NEZzOxY1JaVmu65.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-6NEZzOxY1JaVmu65.exe
Size 236KB
SHA256 d5720e32b74f8fb368be28084c42d621654cad973cf0237f147e4aac6b6ca780
MD5 62995ad6e484ab39afdca1c3cca99e6c
SHA1 92f373f7986b738f8a77c18c28621dc9e192a682
SHA512 330580d3cb762e3963f77e33e35e3673c25bdbe7fc013ed8628d05e7a8b744a22e63c57c93ad677682d77ba83aa94f2eec60437ee64b760bd13ed03aa0162f65
SSDEEP 3072:6J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/W/FnncroP9:OwDeM7iNEkgiOb31k1ECIJ/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1320-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1320-1-0x0000000000400000-0x000000000043B000-memory.dmp