b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe
Size

83KB
MD5

2b805667460ada35359fccb1b6bd73aa
SHA1

b1864eb61ef6e3ceb8933a619f0bfc75e70e4dc6
SHA256

b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0
SHA512

f2832a50f157112f584de747e9e5640ac4d5e6d0f7a4680304b1d49a8d41832b562c09eaa411e737edc97af7bb66a0ca1643b25ca66bef5a6290bbeca2c99ef6
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2224-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2224-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2224-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2224-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2224-30-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe

C:\Users\Admin\AppData\Local\Temp\b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe
"C:\Users\Admin\AppData\Local\Temp\b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-7YeQE97FfXfYfxEA.exe

Filesize
83KB

MD5
b0c2794c4218a8e625f3dd1ca918c563

SHA1
021401825ba3b1db81ebab5c66a7bedcb3313143

SHA256
76a91762d244bb06a54c6d321d5bb121465082f4041b1bb631b692c8d1ebc981

SHA512
be226b98453c3916346b988fde3b8b7630c51cebc241a55a98bd51627859a9ef711949d99e7bf839747982aba6ca68fa489ebb0709abd9e1c80e0128b7d533e4

Download Submit
memory/2224-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2224-30-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download