d285aec37100b88f8521ab4646e566c87b300f957522dc6441eb732617828ed8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d285aec37100b88f8521ab4646e566c87b300f957522dc6441eb732617828ed8N.exe
Size

83KB
MD5

08a87c4ce0b618ddf731573eaad988b0
SHA1

e783bc954d0e39ff34694d763166e071db84b318
SHA256

d285aec37100b88f8521ab4646e566c87b300f957522dc6441eb732617828ed8
SHA512

c78cafc9465a30b4f2df6be17684a4a6bb971abecf67b26e409434e201670ea43b025a0040a8bb83b6a681e0213ad1d99dc1d9f357a3fa7e9227e29c2c951cdc
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bKa:LJ0TAz6Mte4A+aaZx8EnCGVubN

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2188-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2188-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0016000000005587-12.dat	upx
behavioral1/memory/2188-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2188-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d285aec37100b88f8521ab4646e566c87b300f957522dc6441eb732617828ed8N.exe

C:\Users\Admin\AppData\Local\Temp\d285aec37100b88f8521ab4646e566c87b300f957522dc6441eb732617828ed8N.exe
"C:\Users\Admin\AppData\Local\Temp\d285aec37100b88f8521ab4646e566c87b300f957522dc6441eb732617828ed8N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-G6Gq52Vi9zzhe4Bc.exe

Filesize
83KB

MD5
5eda11437461445f5f7d640a823004fb

SHA1
e822c4eb8bcf1c1ebcff1289f822d5c05998ffff

SHA256
a38b6c44084cea133f5ab2da9ae269c3c0cb49dffbe0ab922642a2affd5b93dc

SHA512
db6b4ef3649a249eceb86f3ca47eeb0210e3d0dacc88fe8c5f7ebec48546e06350f97c326a553d3395de519789f1eae0a0d674a5d04aec8839c363f724a6bc2f

Download Submit
memory/2188-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2188-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download