427c47d17379e8feb036a1bd7bf4f61955a4b34497418443b2a94f1d358b84b3

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
427c47d17379e8feb036a1bd7bf4f61955a4b34497418443b2a94f1d358b84b3N.exe
Size 236KB
Sample241109-xta29azfrf
SHA256 427c47d17379e8feb036a1bd7bf4f61955a4b34497418443b2a94f1d358b84b3
MD5 4af90d19b85fb0c91c1d24feb4f2f360
SHA1 6e6305a720338b8a0b6c1b650bd25b69a0251a03
SHA512 5f65a4f119eb4898a23e034f47acdb229b19e05c3c0b2663062b7d5e0a1232fb44eb5a64af05e60fefaa7fd27e7259394530646cb99f1f9696f039296e81fa1f
SSDEEP 3072:tJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/X/FnncroP9:XwDeM7iNEkgiOb31k1ECHJ/F
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1000-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1000-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0008000000023c75-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	427c47d17379e8feb036a1bd7bf4f61955a4b34497418443b2a94f1d358b84b3N.exe

C:\Users\Admin\AppData\Local\Temp\427c47d17379e8feb036a1bd7bf4f61955a4b34497418443b2a94f1d358b84b3N.exe
"C:\Users\Admin\AppData\Local\Temp\427c47d17379e8feb036a1bd7bf4f61955a4b34497418443b2a94f1d358b84b3N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-Y54rcyxl1xUnfaRD.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-Y54rcyxl1xUnfaRD.exe
Size 236KB
SHA256 5a27e859f8f7f88b1fceba3b129f5bd904db5426229696f886a4797f4695a16c
MD5 016db94aa745edd662753dc3f1f1aaa3
SHA1 61f48f7cbf70bd44b1500df009143133c2be89b4
SHA512 bee2cab36ddd56766a2b417e2178a4c5ca56f34509d4dd18f90f048e56b613b9511fd5708d0045a4d1cdd7c141a72eec22372cd2b114a62b0c341d5e52dad67b
SSDEEP 3072:tJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/U/FnncroP9:XwDeM7iNEkgiOb31k1ECyJ/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1000-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1000-1-0x0000000000400000-0x000000000043B000-memory.dmp