Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 06:54

General

  • Target

    b59a4a0157f290891718333e8f79521c8ba5eb8ad89164a347e4f7d273b12c1bN.exe

  • Size

    83KB

  • MD5

    3fa1f215e18f461995b3c5c8a6eddbb0

  • SHA1

    d90f8fe980a7c644f17331ba330e83815e9fd412

  • SHA256

    b59a4a0157f290891718333e8f79521c8ba5eb8ad89164a347e4f7d273b12c1b

  • SHA512

    5232b5b0275bd252d0b72576647389c65b649cab94842980b086fc57f04f7b2d537f1946ebb4d9565191b7aafd6fccf1d3d4b73f79c01467574d472ef0f94843

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+GK:LJ0TAz6Mte4A+aaZx8EnCGVuG

Score
5/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b59a4a0157f290891718333e8f79521c8ba5eb8ad89164a347e4f7d273b12c1bN.exe
    "C:\Users\Admin\AppData\Local\Temp\b59a4a0157f290891718333e8f79521c8ba5eb8ad89164a347e4f7d273b12c1bN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-N2ctuGZPqALSWdzR.exe

    Filesize

    83KB

    MD5

    3e66c8aedd82d0b9413e3fdb7f708b51

    SHA1

    a6ee89bc52c6a4dacbeba46f0483abb7f9ac2878

    SHA256

    9af9d405aabee924effc74e78576b07399378bc86061e04f664520bfd750865c

    SHA512

    7262e305921ed1adb7fbfc90b4458d367b786133c2eb7c35508f9bdb24c107fa3a6fa8e9d29e24d7afc6750c8168f5a10db22f7fbbe1c775f29b6937f61698db

  • memory/2980-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2980-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2980-7-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2980-14-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2980-22-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB