b73cf4649ee125653af41269b6ffa4f49f04ed809c43e8a520d094a3473477df

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b73cf4649ee125653af41269b6ffa4f49f04ed809c43e8a520d094a3473477df.exe
Size

83KB
MD5

44e098dcb0511902409b8457b4599f89
SHA1

aa21680489fb5008001c3ea8515668cc924dd60d
SHA256

b73cf4649ee125653af41269b6ffa4f49f04ed809c43e8a520d094a3473477df
SHA512

fca178cf647bfca4e69438814347eda3149fab41f0489f058a94fe58da86d3f05a5f954f9233a4b34fb852bc5b4d0ea6958bc4029e124dd7cc19a557c958db77
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+gK:LJ0TAz6Mte4A+aaZx8EnCGVug

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/956-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/956-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/956-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/956-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/956-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/956-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/956-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b73cf4649ee125653af41269b6ffa4f49f04ed809c43e8a520d094a3473477df.exe

C:\Users\Admin\AppData\Local\Temp\b73cf4649ee125653af41269b6ffa4f49f04ed809c43e8a520d094a3473477df.exe
"C:\Users\Admin\AppData\Local\Temp\b73cf4649ee125653af41269b6ffa4f49f04ed809c43e8a520d094a3473477df.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-SrN9lQ0FAQ7If13T.exe

Filesize
83KB

MD5
92183945ab545d0ecb9b8be8828ee40f

SHA1
6a5d663f4413a10ab3db16616170f3721d26bfe7

SHA256
dac0f093f6dbd7042722b0856a229f3a64cf8b3290b526b80163aede53a3186e

SHA512
6f226abb8aaa6bc228a2e82f9203fd6650a553893427663df0d73eddc2ee814238e116c49504a2c9d8c4adfb6687bfd9592348c771ba4831ebdf7aa0dc27a51b

Download Submit
memory/956-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/956-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/956-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/956-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/956-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/956-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/956-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download