b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe
Size

83KB
MD5

2b805667460ada35359fccb1b6bd73aa
SHA1

b1864eb61ef6e3ceb8933a619f0bfc75e70e4dc6
SHA256

b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0
SHA512

f2832a50f157112f584de747e9e5640ac4d5e6d0f7a4680304b1d49a8d41832b562c09eaa411e737edc97af7bb66a0ca1643b25ca66bef5a6290bbeca2c99ef6
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4552-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4552-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4552-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4552-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023cc6-12.dat	upx
behavioral2/memory/4552-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4552-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4552-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe

C:\Users\Admin\AppData\Local\Temp\b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe
"C:\Users\Admin\AppData\Local\Temp\b90cd08ca7a2520d4dd0dd129c6fce0cb93a2595414845ea8d18cce917d3e5c0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-V5ZqD35WPe2ube95.exe

Filesize
83KB

MD5
cfcce8f3d97a139542f6af8d44d7ebbb

SHA1
df50ee9c2eb956a92aff8b22f0a39b15fba83335

SHA256
33e50762afe9a685a23b20bb182e33c2230bd99bd733d8f732551f017adcb9c7

SHA512
405a3b72a7bf2500c67045a907cbd8754c11ebd6de3873e593e2d44f99d240689c4c555c7ed94306a4d35d64c61a7cc0c6dd08c114b3d1ecebeb434d163a5db7

Download Submit
memory/4552-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4552-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4552-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4552-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4552-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4552-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4552-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download