190b84624708d3c9fa36d21280d9e425aa47515ca4dff57c38443fcbf01191a5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

190b84624708d3c9fa36d21280d9e425aa47515ca4dff57c38443fcbf01191a5N.exe
Size

83KB
MD5

ff54fd2c8851e560cc3d731fa4e6b200
SHA1

e09bd8aaff73ab43bcdcdd745fac9798e5118690
SHA256

190b84624708d3c9fa36d21280d9e425aa47515ca4dff57c38443fcbf01191a5
SHA512

b21b64f0c9e560f94634a6538c85c6da749fc1b91ad137ab4b98efaa3524da075c588ccbbeb0dce9990999ee3228cd67f251ea7694a43e4e5311267e605f7aab
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+9K4:LJ0TAz6Mte4A+aaZx8EnCGVu9f

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2176-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2176-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2176-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2176-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	190b84624708d3c9fa36d21280d9e425aa47515ca4dff57c38443fcbf01191a5N.exe

C:\Users\Admin\AppData\Local\Temp\190b84624708d3c9fa36d21280d9e425aa47515ca4dff57c38443fcbf01191a5N.exe
"C:\Users\Admin\AppData\Local\Temp\190b84624708d3c9fa36d21280d9e425aa47515ca4dff57c38443fcbf01191a5N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-jKOboBXWcId4oXgY.exe

Filesize
83KB

MD5
93104f48bf4750197cc9cbd5dc7c3c5f

SHA1
c425d721992ff9ef4c7a828098432664742c1230

SHA256
660ea20db921c40bf09fd0e2d17647c6b84e750a219a6484439b334e437829da

SHA512
0b4bf7f248ac62b194922a72e01bed53ac5c38634cb07ca9f63ad0f8504b8b0c215cd1f1e674b1ef1f2170795e97ef51ff74d6f78e6513207992320d4d908e93

Download Submit
memory/2176-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2176-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2176-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2176-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2176-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download