ac424c0992fefd8aa05c0fc548259dc226b1c6bf5cccb0436ed2bf6a334f7205

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac424c0992fefd8aa05c0fc548259dc226b1c6bf5cccb0436ed2bf6a334f7205N.exe
Size 236KB
Sample241109-2emvqatend
SHA256 ac424c0992fefd8aa05c0fc548259dc226b1c6bf5cccb0436ed2bf6a334f7205
MD5 526551eaafdfa081c15509ffb9c20c30
SHA1 3fb8a19b71a7c43a4efa42abb59e4dd9d4e4d5b1
SHA512 f0d896a047ab61c6a67b498c696c6d4daec3697f7422168c2e85bdd4b655b17fe8f540c97b99b91530d0d466046b31b6073d0aac5939231c617822439aa2a8f8
SSDEEP 3072:7J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/Y/FnncroP9:9wDeM7iNEkgiOb31k1ECGJ/F
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5028-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/5028-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0009000000023c44-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac424c0992fefd8aa05c0fc548259dc226b1c6bf5cccb0436ed2bf6a334f7205N.exe

C:\Users\Admin\AppData\Local\Temp\ac424c0992fefd8aa05c0fc548259dc226b1c6bf5cccb0436ed2bf6a334f7205N.exe
"C:\Users\Admin\AppData\Local\Temp\ac424c0992fefd8aa05c0fc548259dc226b1c6bf5cccb0436ed2bf6a334f7205N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-us0mabavHDY68qHz.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-us0mabavHDY68qHz.exe
Size 236KB
SHA256 5b86e1daf3a505e4da6c8fca43d0ab1ae674003d1db2dad28fa7b8c0793da36a
MD5 1241e50600e80c854800c7dffdd8e547
SHA1 63e6731d3ce7b59128f7c27fbc2ad48347c5d455
SHA512 10193973d70ab59abf66fba7b4566bb6413a94df10d7966e3d465aab01f0cef8363284968d80231660c09e3a60fb5d291444c978103fc8bb5849b0798d3393af
SSDEEP 3072:7J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/+/FnncroP9:9wDeM7iNEkgiOb31k1ECwJ/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5028-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5028-1-0x0000000000400000-0x000000000043B000-memory.dmp