1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28a

Analysis

max time kernel
111s
max time network
97s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe
Size

83KB
MD5

c7aa6abf630313c3313aaf2c012fbc50
SHA1

9ea6e09089452a8ceb5c17979d6007ee3a1d9ae2
SHA256

1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28a
SHA512

09486e72eaeb542629f0cdf035db2f1f00ac48329b724d7009a769044d8d9add569f18b3d90aedb70150a87dcb489c7101fe72620a71992aecc59ca93e23080e
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dK:LJ0TAz6Mte4A+aaZx8EnCGVud

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1680-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1680-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0004000000018334-11.dat	upx
behavioral1/memory/1680-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1680-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe

C:\Users\Admin\AppData\Local\Temp\1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe
"C:\Users\Admin\AppData\Local\Temp\1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-oxEJoJC5X7dvuTTv.exe

Filesize
83KB

MD5
fc9bb1132a21d4482cf55daacb5e32eb

SHA1
a55e8d962905d1a1404c2c2b501589ad338339bd

SHA256
e1a3c714597b771cbf2c9fdb2e5912be2c134e616541837c18e25a399d9841a6

SHA512
6ddd1bc690332e1dce9aa0e703954fc3c0bdfc614bfc4b133d96a8bd0ec2f35e053481b12f704d6d229daa33a946604c2511bb32798c2d578bf54b755cfaeb8a

Download Submit
memory/1680-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1680-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1680-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1680-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1680-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download