057b577327332eeb07ca48128f9d9ca010eb7ab69b0b093abad2338af3418c17

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

057b577327332eeb07ca48128f9d9ca010eb7ab69b0b093abad2338af3418c17.exe
Size

83KB
MD5

a7f4605ed4b9e223f3ad90a0502b2e99
SHA1

5a586e706d85cfdde730cba0e2fb49abe6f38201
SHA256

057b577327332eeb07ca48128f9d9ca010eb7ab69b0b093abad2338af3418c17
SHA512

40c76dfc8ccb302b257c172bdaaf1fe23719ac0a23ea5d17f577399e150303745a391face9664ea310302aba29e86c149e3e59e880d2cd7405c0fb18f660adc7
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+9Ku:LJ0TAz6Mte4A+aaZx8EnCGVu9/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2404-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2404-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2404-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2404-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	057b577327332eeb07ca48128f9d9ca010eb7ab69b0b093abad2338af3418c17.exe

C:\Users\Admin\AppData\Local\Temp\057b577327332eeb07ca48128f9d9ca010eb7ab69b0b093abad2338af3418c17.exe
"C:\Users\Admin\AppData\Local\Temp\057b577327332eeb07ca48128f9d9ca010eb7ab69b0b093abad2338af3418c17.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-wk7hFGUZGOH65LBE.exe

Filesize
83KB

MD5
7fb68996ced5fb6bb70ee0a0e5994464

SHA1
a5495d7b37019dfd676e48ddbd4a49d0bbcbff67

SHA256
331c8841ca41e5850adeadc5415a84f9512d0635f4fa496c283d3dd6c72ca67f

SHA512
961f3424ea589689acfb947a534bc200c84aedd21c23b2c67ffeded566347537aa8a892ada454dd539391a2e6c46160fac616373769c41ca1811e4bcda07fb5d

Download Submit
memory/2404-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2404-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download