a52658e652382ecc3b9b287b45807d0ed0ee96860652f87fc6e173dab59a0608

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a52658e652382ecc3b9b287b45807d0ed0ee96860652f87fc6e173dab59a0608N.exe
Size

83KB
MD5

b3ece6c8dba1f69930310431d0dc74e0
SHA1

c9654138bd1d69b4bf00004bb0e086e340f77e7d
SHA256

a52658e652382ecc3b9b287b45807d0ed0ee96860652f87fc6e173dab59a0608
SHA512

b12c673d910991f1595a485d1ded1f72f06d4678df818c97d4b9ec63d0c406f838c9146225a020fdc7317180ce3d8663e220af564012ae811b4a5d260bf15b0c
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YKV:LJ0TAz6Mte4A+aaZx8EnCGVuYK

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4904-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4904-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4904-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0032000000023b84-12.dat	upx
behavioral2/memory/4904-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4904-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a52658e652382ecc3b9b287b45807d0ed0ee96860652f87fc6e173dab59a0608N.exe

C:\Users\Admin\AppData\Local\Temp\a52658e652382ecc3b9b287b45807d0ed0ee96860652f87fc6e173dab59a0608N.exe
"C:\Users\Admin\AppData\Local\Temp\a52658e652382ecc3b9b287b45807d0ed0ee96860652f87fc6e173dab59a0608N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-EH3LMyo1pl0h7ga0.exe

Filesize
83KB

MD5
9d633d4bad69bfada380001c3ef71d88

SHA1
7265958e9a0df7a2b3afea53f3dffa361f2832f7

SHA256
e7646a6540aca76ded7b4428b8934b1d67459e00fc911f6a3cf0a73a5c9169a7

SHA512
2630b263ef378d77f1a70b632b8fa791844e44623b7ec9ac2856e45a987c5ca256d2648a800d911391fb418c8a5621b78ac58be79f9244121281cb8ec1664b0a

Download Submit
memory/4904-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4904-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4904-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4904-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4904-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download