5aea13c095cfa7a3efa61de10f2e8a6c908f4c167997e6e429b2093808b4aaee

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aea13c095cfa7a3efa61de10f2e8a6c908f4c167997e6e429b2093808b4aaee.exe
Size

83KB
MD5

d6d7f1080195f21ca45b3934399529a8
SHA1

040e22cb4c84586cbf4669022eef58d4b0ac3295
SHA256

5aea13c095cfa7a3efa61de10f2e8a6c908f4c167997e6e429b2093808b4aaee
SHA512

4dc89cf2ca396472e152c917298b3f15d7d82b33e61dc91927ba9c21ee0303b48c17c3ba5699e25586981e48ed1b729627b4455e295df481924fbf39cf0f3848
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+EKu:LJ0TAz6Mte4A+aaZx8EnCGVuE/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2084-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2084-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2084-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2084-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2084-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2084-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5aea13c095cfa7a3efa61de10f2e8a6c908f4c167997e6e429b2093808b4aaee.exe

C:\Users\Admin\AppData\Local\Temp\5aea13c095cfa7a3efa61de10f2e8a6c908f4c167997e6e429b2093808b4aaee.exe
"C:\Users\Admin\AppData\Local\Temp\5aea13c095cfa7a3efa61de10f2e8a6c908f4c167997e6e429b2093808b4aaee.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-exy5Dc1JIRaHBasj.exe

Filesize
83KB

MD5
65a16a8c62446246512c965a6ee0bf7c

SHA1
de6c04e63f5cb739f40ddad2f7c509552685b5cc

SHA256
3a6cb8217ab1817f7c3672d3a0fedd2c8c7f6635ea9b5db556f21e43c20ffd7f

SHA512
301e756854ae68615c022c86d3e715b0e229c4b0c1ee807ae2b37f1688bb266e158048a1cd0f607f0219852973f943b56942940d65d97d3130dc9f348ff4d08e

Download Submit
memory/2084-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2084-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2084-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2084-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2084-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2084-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download