Analysis

  • max time kernel
    110s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 18:43

General

  • Target

    9f3beedef87f92a431ab43b1f186d9dcc114bd8fe0383a6abf031cd3b4ee5717N.exe

  • Size

    83KB

  • MD5

    4556ade59d42ba40b1b61fbfbfa05b70

  • SHA1

    e7dbfa81d4f31a23f28b04360a9364f9c786f6d4

  • SHA256

    9f3beedef87f92a431ab43b1f186d9dcc114bd8fe0383a6abf031cd3b4ee5717

  • SHA512

    6431a95aa8c5431b6af303819f74205cdda495e464de934d1da12419514d4d0be54a4ca24927c2fc4c2f4fba141516312132bdd9383a311da2146db0a97248b5

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VKu:LJ0TAz6Mte4A+aaZx8EnCGVuV/

Score
5/10

Malware Config

Signatures

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f3beedef87f92a431ab43b1f186d9dcc114bd8fe0383a6abf031cd3b4ee5717N.exe
    "C:\Users\Admin\AppData\Local\Temp\9f3beedef87f92a431ab43b1f186d9dcc114bd8fe0383a6abf031cd3b4ee5717N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-y1xPkJTpb4TLoKWM.exe

    Filesize

    83KB

    MD5

    bee662a4f3da4f7fc256ecd0d47824ee

    SHA1

    b2aea4a377d0e316f303f418a7ac7a1d4b97b806

    SHA256

    f29f0d528672b0d92c0fa8dde066cf7c555e707926bcfba91fb9e15799b5d899

    SHA512

    07326ca8577e11cb1999a2e498c0baf08a3e1514b04f53e15918745c02eb4c912c52174ec69600d0d17e744070adcbed60d67fd13ef8276769dec989d86f1c17

  • memory/840-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/840-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/840-4-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/840-8-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/840-11-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/840-15-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/840-19-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB