eb417122279407fc50536ae514a1e50bb6fd6b23b8867649d8cb4f1d2f7d48fb

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb417122279407fc50536ae514a1e50bb6fd6b23b8867649d8cb4f1d2f7d48fbN.exe
Size 236KB
Sample241107-trxlpavmcw
SHA256 eb417122279407fc50536ae514a1e50bb6fd6b23b8867649d8cb4f1d2f7d48fb
MD5 197a1751ead43424629a9803156ff1a0
SHA1 234b0b76329eafb7087c392fb8e49abf8effbff6
SHA512 49cd5c13eee6ff4cc1c4f8c7757d58ceeed4bff5446bcf4d7395340c811dfc6f7d3433027d817407e8e7d4cb14bd04a4bab2c2b1d42deac5511bc2add72f3753
SSDEEP 3072:eJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/m/FnncroP9:iwDeM7iNEkgiOb31k1ECoJ/F
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/364-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/364-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000b000000023b88-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb417122279407fc50536ae514a1e50bb6fd6b23b8867649d8cb4f1d2f7d48fbN.exe

C:\Users\Admin\AppData\Local\Temp\eb417122279407fc50536ae514a1e50bb6fd6b23b8867649d8cb4f1d2f7d48fbN.exe
"C:\Users\Admin\AppData\Local\Temp\eb417122279407fc50536ae514a1e50bb6fd6b23b8867649d8cb4f1d2f7d48fbN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-QGgQs2ZihJpDN8rt.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-QGgQs2ZihJpDN8rt.exe
Size 236KB
SHA256 3f89181f91bc3fa9721f8c5f674684c1bacb79a1e69f49623e86f2e98699720e
MD5 5293c9e249c9d4cf60e2d48dcb9199a5
SHA1 05d37518ab27cbcc5d5d3a90940d9db8a4d864b7
SHA512 31b46a98596141f510e9acd2383e11638b7792958a1a5ddf5cdc65d79dd387de0baa4d93fada3c9f0634dec1f8b8f917a1053e3dd8576b640b36bbb373b7d942
SSDEEP 3072:eJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/O/FnncroP9:iwDeM7iNEkgiOb31k1ECAJ/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/364-1-0x0000000000400000-0x000000000043B000-memory.dmp