1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28a

Analysis

max time kernel
111s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe
Size

83KB
MD5

c7aa6abf630313c3313aaf2c012fbc50
SHA1

9ea6e09089452a8ceb5c17979d6007ee3a1d9ae2
SHA256

1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28a
SHA512

09486e72eaeb542629f0cdf035db2f1f00ac48329b724d7009a769044d8d9add569f18b3d90aedb70150a87dcb489c7101fe72620a71992aecc59ca93e23080e
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dK:LJ0TAz6Mte4A+aaZx8EnCGVud

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1192-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1192-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1192-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1192-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1192-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023c9e-12.dat	upx
behavioral2/memory/1192-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1192-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe

C:\Users\Admin\AppData\Local\Temp\1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe
"C:\Users\Admin\AppData\Local\Temp\1c916fd0d5660a19250d3f10326769413b5a964b2f271624f5e3d8c45e0af28aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-CCrlp0gSKRqTzo4b.exe

Filesize
83KB

MD5
2b04a224c6e6a57f86d101961b3592ed

SHA1
db6199ecdd39d01445d767e4822f3a061d4a5aea

SHA256
d506cf864e36eb1069365c22fa12ad0576e4e1c6ed08eff0f2cde3a1df1c56f8

SHA512
de912dc321d5a6a577d21e98dcda80cf766dec92038c1089bc1a66f5d27595f33b85786a413ea267171f68d1f33792246f90bd3657f208f2e0f77fab5e4824a0

Download Submit
memory/1192-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1192-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1192-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1192-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1192-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1192-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1192-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download