cd7b4d9fcd717923b7dd53b655c038469f17cbb8866e230676c0dfa1234f7e24

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd7b4d9fcd717923b7dd53b655c038469f17cbb8866e230676c0dfa1234f7e24.exe
Size

236KB
MD5

361ccb67cf778ffb2852c0da697dad32
SHA1

5523d229081284fb60a0f3372dc07911f1935d8f
SHA256

cd7b4d9fcd717923b7dd53b655c038469f17cbb8866e230676c0dfa1234f7e24
SHA512

a0ac5f29572158bc16a5b5257bd1a67c1aa30c8031e0664c5d1c750179cc72c9ddb4e6ee4cc92a7086db0f34177181e170e6927ae6a26896658d9876227a94aa
SSDEEP

3072:OJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/j/FnncroP9/:SwDeM7iNEkgiOb31k1ECTJ/F/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2668-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2668-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x000b0000000122ea-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd7b4d9fcd717923b7dd53b655c038469f17cbb8866e230676c0dfa1234f7e24.exe

C:\Users\Admin\AppData\Local\Temp\cd7b4d9fcd717923b7dd53b655c038469f17cbb8866e230676c0dfa1234f7e24.exe
"C:\Users\Admin\AppData\Local\Temp\cd7b4d9fcd717923b7dd53b655c038469f17cbb8866e230676c0dfa1234f7e24.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-BUp9iSJ1ZqoZiYp4.exe

Filesize
236KB

MD5
4134fd469355a249c060760c3f82374b

SHA1
5ed17d6d2842ba4f7880760f7ba89a79d09e878c

SHA256
7cc0c52b82c3d6e88fc98f4ae1a7b96c7620f920f8244edb871a033cd5555feb

SHA512
879715f09c8b8c1e09c61519142b16ba9c006e0f15a5ad1271202790c0b05df4b83ded5165f445088cbbcdff16bd5d70048d2078258a0a84b39ed9512e220c72

Download Submit
memory/2668-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2668-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download