b920455ac679720ae3d7a1f6596193a3c112c27f5122ee75d898f644f03e1fb1

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b920455ac679720ae3d7a1f6596193a3c112c27f5122ee75d898f644f03e1fb1N.exe
Size 236KB
Sample241109-vs7cys1pak
SHA256 b920455ac679720ae3d7a1f6596193a3c112c27f5122ee75d898f644f03e1fb1
MD5 651ebeb7437d9a2e74591ced58309be0
SHA1 378f3b3bda9100a07c7bc640f3b82f721406e115
SHA512 172221bdae6c45c20dbc9847936b93871bb7057188aba059b2fe9aa3feeef9adf42cc71bef7f7ec73f9b7ec8d14caef03de4e02507fd929123f17b42e1148841
SSDEEP 3072:rJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/3/FnncroP9:twDeM7iNEkgiOb31k1ECnJ/F
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4088-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4088-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0009000000023bef-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b920455ac679720ae3d7a1f6596193a3c112c27f5122ee75d898f644f03e1fb1N.exe

C:\Users\Admin\AppData\Local\Temp\b920455ac679720ae3d7a1f6596193a3c112c27f5122ee75d898f644f03e1fb1N.exe
"C:\Users\Admin\AppData\Local\Temp\b920455ac679720ae3d7a1f6596193a3c112c27f5122ee75d898f644f03e1fb1N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-F9OH5Kd5xGjh80b8.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-F9OH5Kd5xGjh80b8.exe
Size 236KB
SHA256 fcbb26ac5fbf6aaaff7d8885ce1f7d66396f3b5c5bb5a16c075f695d92ff892f
MD5 296bc44b95d1efeeab80a3abb0eb2cc6
SHA1 8fab8cf670f112283e855e569d0deeba02c1eef6
SHA512 e98fe83560798ed881479881ad67c7f47a854dfeaf380cdf46daae5ba866d48a56b6ed58d91025263f0f802eb2326529de2f61365f46ae7b40ebd2dae10f6786
SSDEEP 3072:rJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/3/FnncroP9:twDeM7iNEkgiOb31k1ECHJ/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4088-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4088-1-0x0000000000400000-0x000000000043B000-memory.dmp