c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe
Size

236KB
MD5

8c1594d6f7c22f4f0cee05d5c90bef30
SHA1

2b4a95b5d25c3af4b842b7efa683d1cda3355e0f
SHA256

c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949
SHA512

a7b0745717d9251b7e205266fa82aec854cd57abc4779ed0fd61409f3cad010b16fe7f9c20de8375466053a6e60634863e6a58110e008d7442d539413e87bbf6
SSDEEP

3072:ZJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/+/FnncroP9:jwDeM7iNEkgiOb31k1ECAJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2384-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000013d08-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe

C:\Users\Admin\AppData\Local\Temp\c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe
"C:\Users\Admin\AppData\Local\Temp\c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-VXyKciKxAYzQhbqo.exe

Filesize
236KB

MD5
02daf959a304d356c431bf1ae99c1acb

SHA1
a27a8077c3ea5224b1eda6ead669263332627385

SHA256
747e8910a82b6744fad464eebfbed2fc0857df56b179b5cb67001b5efa998cbe

SHA512
be94a7d7e24541c391109974e42292dd72c4248f62a0c98ef450ecc5263683579acbdb9aaf41702ca0fc954576b6ebd4aba62acdad3cfad5ff93bfb537fd9c7c

Download Submit
memory/2384-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2384-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download