c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe
Size

236KB
MD5

8c1594d6f7c22f4f0cee05d5c90bef30
SHA1

2b4a95b5d25c3af4b842b7efa683d1cda3355e0f
SHA256

c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949
SHA512

a7b0745717d9251b7e205266fa82aec854cd57abc4779ed0fd61409f3cad010b16fe7f9c20de8375466053a6e60634863e6a58110e008d7442d539413e87bbf6
SSDEEP

3072:ZJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/+/FnncroP9:jwDeM7iNEkgiOb31k1ECAJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4780-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4780-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000b000000023b87-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe

C:\Users\Admin\AppData\Local\Temp\c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe
"C:\Users\Admin\AppData\Local\Temp\c1c29db4074f8143dfbf6304f71b1b41524a9b097c264286bfb3d8ac49dd3949N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-1R1HneW4LHmMjqjc.exe

Filesize
236KB

MD5
0e6f28fadc55342dd459bb9d554bfa03

SHA1
8b3e2c115af3b8d2d7e09d60c4e71bbb35209f8a

SHA256
7aa1dbcfb3a4b21e57f7260054a138aac89554a694392dfb9999726a73a2ad07

SHA512
8cb2d17fe1dc60cc43ba984e716edd7cdbdc5ec6e14baf55e55452fe1a991e234e7b19f0f05381868aead711a835e841ec97e5c01239f4ff0965ba82ce4d5a32

Download Submit
memory/4780-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4780-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download