Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 15:53

General

  • Target

    ae48bdc31cfcf7ff37f823211cfe08eced82832beb87b2ebe019101755b72f0cN.exe

  • Size

    83KB

  • MD5

    0664a4d61afcc0d9e74668ac5be9e260

  • SHA1

    f34abec4f9ae3a074afbbbc33481ae4cdf4b968e

  • SHA256

    ae48bdc31cfcf7ff37f823211cfe08eced82832beb87b2ebe019101755b72f0c

  • SHA512

    d35bf79e7eaae1021ec6a07d1ab26fc92793a24671e3c8019b6379bacabd7f9af63db2a5588867db2caacc4170b4f381818b4b9f1abf7b803d957dcf43ba786b

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YK:LJ0TAz6Mte4A+aaZx8EnCGVuY

Score
5/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae48bdc31cfcf7ff37f823211cfe08eced82832beb87b2ebe019101755b72f0cN.exe
    "C:\Users\Admin\AppData\Local\Temp\ae48bdc31cfcf7ff37f823211cfe08eced82832beb87b2ebe019101755b72f0cN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-RwOy6nsciuykgeJh.exe

    Filesize

    83KB

    MD5

    c320345d87916ac32958e19fd32b8716

    SHA1

    d35a226dbf2e65ba841996d1efb86875b2e3cfe8

    SHA256

    2b18a93c7dc6d95ae58f12328ae7bdad6b87ba17b7ed35177939d60032863dea

    SHA512

    04c01ab2d063e35ae4de697d2c31d0820095c2a4881ab28b3831ced37baba9a90e169b668865163ff2bb6b7a297e7ebdc073c4e034852c70d4c8a4ba03574a91

  • memory/2740-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2740-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2740-8-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2740-15-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2740-22-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB