2bc938a7f1c5aa3f5155f06a82094a10e668a4b5218c0209684b99e49b2e8a69

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bc938a7f1c5aa3f5155f06a82094a10e668a4b5218c0209684b99e49b2e8a69N.exe
Size

83KB
MD5

5a15bd2c7b4a2a007d598cef532bdd70
SHA1

fdb931958858cf3a34d1985b588317b3d8f943a2
SHA256

2bc938a7f1c5aa3f5155f06a82094a10e668a4b5218c0209684b99e49b2e8a69
SHA512

859e838710025e73d6b5a8468d5976b8ce4953d150be0c00a6502255137698184cded156bfa4f47d03b5898c7cfa7a23e82c5513eb36665345a95009b9d2f966
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+wKV:LJ0TAz6Mte4A+aaZx8EnCGVuwK

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2940-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2940-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2940-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2940-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2bc938a7f1c5aa3f5155f06a82094a10e668a4b5218c0209684b99e49b2e8a69N.exe

C:\Users\Admin\AppData\Local\Temp\2bc938a7f1c5aa3f5155f06a82094a10e668a4b5218c0209684b99e49b2e8a69N.exe
"C:\Users\Admin\AppData\Local\Temp\2bc938a7f1c5aa3f5155f06a82094a10e668a4b5218c0209684b99e49b2e8a69N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-aJagmoPzkId1lgay.exe

Filesize
83KB

MD5
c1daa550c517ce193472cb78d5862f98

SHA1
917fe259d61e06ce4e109990f86949e57ccf85eb

SHA256
0640ed5f43bf2290917d2673f6d944ff0e2ca1a37193b9389efd5b726188784a

SHA512
16bfad86941169a11fb05caf5e04c4699e3e3a422e39d512119571042fe711e92c9b7eaa3f7c84dacd4b3acffd15f208403ed549c5ec73831222138cb8cf89b5

Download Submit
memory/2940-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download