4038bb0425323d6c0430575ccb0d88cdf8082aac6b68faabeaf2699eca7f1905

Analysis

max time kernel
110s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4038bb0425323d6c0430575ccb0d88cdf8082aac6b68faabeaf2699eca7f1905.exe
Size

83KB
MD5

b7163f92a0f3805d135eecb6976c3da6
SHA1

aaff599fe0043efd86eb8058f28cb6f5922202f1
SHA256

4038bb0425323d6c0430575ccb0d88cdf8082aac6b68faabeaf2699eca7f1905
SHA512

a444b06132b1e291b3836807051cf6604ad77678f8d66be95f83027029a5d504135b276e3a0674bd626560c22508a771a1c360d2d01f25b77c627d97d01cf9bd
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xsKu:LJ0TAz6Mte4A+aaZx8EnCGVuxs/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4216-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4216-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4216-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4216-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023ca7-12.dat	upx
behavioral2/memory/4216-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4216-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4038bb0425323d6c0430575ccb0d88cdf8082aac6b68faabeaf2699eca7f1905.exe

C:\Users\Admin\AppData\Local\Temp\4038bb0425323d6c0430575ccb0d88cdf8082aac6b68faabeaf2699eca7f1905.exe
"C:\Users\Admin\AppData\Local\Temp\4038bb0425323d6c0430575ccb0d88cdf8082aac6b68faabeaf2699eca7f1905.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-ypzNEOs1RC2spWyK.exe

Filesize
83KB

MD5
666cb5f763eaf53492fe683c92609468

SHA1
939e078724e2ec7aa5a84c530a7119e91cfb5168

SHA256
f897ebb1d9d9eb2d6013e1f06fadd6164b38f28bdc74fbc4bb0396ed11e57553

SHA512
e9070c71281523c81a82dbfa814c9e041dd2eff90524b6e54b44322552dff4959b22bcb607ac9a7c1ef763ceb17aa8efd4d0c60e9c5fc70602ff14a425e05982

Download Submit
memory/4216-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4216-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4216-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4216-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4216-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4216-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download