93803ad6e0cab03e44d6ad84c6abd5f0b4062de134604eb0069bf03905fbafc3

Analysis

max time kernel
120s
max time network
99s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93803ad6e0cab03e44d6ad84c6abd5f0b4062de134604eb0069bf03905fbafc3.exe
Size

236KB
MD5

920a17c4635b2d06929cfa9e50484f3d
SHA1

7f03ef739f21f079d76c5fee5a680467566d9a13
SHA256

93803ad6e0cab03e44d6ad84c6abd5f0b4062de134604eb0069bf03905fbafc3
SHA512

df26bbf334e0b6e451de91d099ca2d8a95237bb29620dcf3f2a0646f50b0a430457d89a70c38380cd7aa1ce37bc29139d0964e6ab1a71b166662f2fa776e3c2b
SSDEEP

3072:MJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/f/FnncroP91:QwDeM7iNEkgiOb31k1ECvJ/F1

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2512-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2512-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0008000000018683-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93803ad6e0cab03e44d6ad84c6abd5f0b4062de134604eb0069bf03905fbafc3.exe

C:\Users\Admin\AppData\Local\Temp\93803ad6e0cab03e44d6ad84c6abd5f0b4062de134604eb0069bf03905fbafc3.exe
"C:\Users\Admin\AppData\Local\Temp\93803ad6e0cab03e44d6ad84c6abd5f0b4062de134604eb0069bf03905fbafc3.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-iBJWtBeTLTQpZpsx.exe

Filesize
236KB

MD5
9a6d555825047d6f57a3f579fcaa0632

SHA1
c7e6acbd24379733f56c0d70277feaa265ca9745

SHA256
db3e39610509fab73597b11802e73d4169ace3eefd951cc81db6bab3069b99b9

SHA512
56e54a1afecafba773023fdf3245feff4b68378719d4dfe6fc0660beaeeedc3ac5c34f03360bca65c29b68f2b750c92353902a25875269ff17a573c5ddcbcf87

Download Submit
memory/2512-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2512-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download