Analysis Overview
SHA256
e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1a
Threat Level: Likely benign
The file e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1aN was found to be: Likely benign.
Malicious Activity Summary
UPX packed file
Unsigned PE
System Location Discovery: System Language Discovery
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-09 15:36
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-09 15:36
Reported
2024-11-09 15:38
Platform
win7-20241023-en
Max time kernel
119s
Max time network
92s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1aN.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1aN.exe
"C:\Users\Admin\AppData\Local\Temp\e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1aN.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | wecan.hasthe.technology | udp |
| US | 104.21.59.199:80 | wecan.hasthe.technology | tcp |
| US | 104.21.59.199:80 | wecan.hasthe.technology | tcp |
| US | 104.21.59.199:80 | wecan.hasthe.technology | tcp |
Files
memory/1268-0-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1268-1-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1268-5-0x0000000000400000-0x000000000042A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rifaien2-CdgeZ2dpZz9boYiL.exe
| MD5 | 0cc4696d3f74036e3f2a446896155956 |
| SHA1 | 3ffbbde7f21d65c80d006e200c00b87e5bcb7a3f |
| SHA256 | 07beff9d4264571d1d427e80d4385855fc61e4aa4524066adbc54f232d99e9f0 |
| SHA512 | f9c2d06312cc034de207ffae96953d730cb6581b277c02416eabea3e47a59a60b588d1891bfd7b8cc6e38b33b8e9411227e0f9f719c6f966aa474947074dcacf |
memory/1268-12-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1268-22-0x0000000000400000-0x000000000042A000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-09 15:36
Reported
2024-11-09 15:38
Platform
win10v2004-20241007-en
Max time kernel
120s
Max time network
97s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1aN.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1aN.exe
"C:\Users\Admin\AppData\Local\Temp\e5a88d8fd7ea7d48a418b0c0007a8e40819baf5b4d604f9bc83f2a7938de2a1aN.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | wecan.hasthe.technology | udp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.183.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.209.201.84.in-addr.arpa | udp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
memory/2400-0-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2400-2-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2400-5-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2400-9-0x0000000000400000-0x000000000042A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rifaien2-R1Fqa3kmWCqhxj9j.exe
| MD5 | c1a64fc80fdfa2a02dcc8d2ab010db66 |
| SHA1 | eee2ec2c3ff45b98e3a968271b50be1222df034a |
| SHA256 | 9283afe324dfec2e032a4dfc3fb54d2cad6fa66a1d343888062b373d84cd945f |
| SHA512 | 87ca458b53ef0e9a529994f7a2ee92d57982734d2d62c84437f8d06df86802b56eec7e2e5243a1f9eda22f22421e6647f85dd1e5bfa0e29fe87b91f361f4b7b6 |
memory/2400-13-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2400-21-0x0000000000400000-0x000000000042A000-memory.dmp