Analysis

  • max time kernel
    111s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:20

General

  • Target

    ec3b2d02747f4a6bf13dbabd640f48dd51c773acb19d72229a4e818f5a58532eN.exe

  • Size

    83KB

  • MD5

    1d7c672d7525914d142b3a98d2547540

  • SHA1

    5d96aed8df1cc11e8e2319dbffb41b78a75df400

  • SHA256

    ec3b2d02747f4a6bf13dbabd640f48dd51c773acb19d72229a4e818f5a58532e

  • SHA512

    a270cf0beebf88bc4f1a53f80f009d946d20b9a4362b6c234e9b68d8b0e07159621e5b1a7f771b340d0bd85de50d44af41485b29d024dca4ddc4965334915a23

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK

Score
5/10

Malware Config

Signatures

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec3b2d02747f4a6bf13dbabd640f48dd51c773acb19d72229a4e818f5a58532eN.exe
    "C:\Users\Admin\AppData\Local\Temp\ec3b2d02747f4a6bf13dbabd640f48dd51c773acb19d72229a4e818f5a58532eN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-BSXb8XDfEXbRy3MY.exe

    Filesize

    83KB

    MD5

    43544960bca50cab955a1c8badeacf9b

    SHA1

    c9be325db02fb5855f730ef6cfbb5efaa86c0556

    SHA256

    22b6f6fc6e9406d97b30b560b930358d9caceb7336519cfe3eb19a7011a2213d

    SHA512

    9b4adcfcc7f43588c3f9543e5d06fa8f6dbb335997f57dae54665212b55126184dac1e45bd10c980fdd26be5bdcb450b11dea2843d6b49d3f756496709c79235

  • memory/4352-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4352-2-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4352-5-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4352-9-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4352-13-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4352-19-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4352-23-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB