3587bd209f91476a778f20a8be31e286767a65f0e2bff5db8fa2148db5d729d2

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3587bd209f91476a778f20a8be31e286767a65f0e2bff5db8fa2148db5d729d2.exe
Size

83KB
MD5

0fdc74a85f0109fe3c1f0cad459a5dd4
SHA1

b133e8e7c4b37da2bab3d0fcfad25376326adf89
SHA256

3587bd209f91476a778f20a8be31e286767a65f0e2bff5db8fa2148db5d729d2
SHA512

28206f623eeca82c3eac5cce9ca011b4ba0604845edc8c5a3f6e2c95812b932f922c7f87f7ccb623a0cfe30dcaf9e9451885e9b814588c7b7d4dd4bd8baa0203
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1Ke:LJ0TAz6Mte4A+aaZx8EnCGVu13

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2092-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2092-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2092-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2092-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2092-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3587bd209f91476a778f20a8be31e286767a65f0e2bff5db8fa2148db5d729d2.exe

C:\Users\Admin\AppData\Local\Temp\3587bd209f91476a778f20a8be31e286767a65f0e2bff5db8fa2148db5d729d2.exe
"C:\Users\Admin\AppData\Local\Temp\3587bd209f91476a778f20a8be31e286767a65f0e2bff5db8fa2148db5d729d2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-HtOAoVE99f3qMI8b.exe

Filesize
83KB

MD5
04cfcd73fc932bf1c2a7668853e307a2

SHA1
9ec90a9c7f8bf0fc1d905ad48b525775a8f1f8a2

SHA256
1ac06836aeaf9c8ef56a6ab363b479ae776737e8e71df6792c273a616c4c1cde

SHA512
5dda0f1c53e31f634f54fd35fd4d884500a75ba54862cf9c4ec5740072f419d60b48e492a9b4e9f0342bfc8516f62030db84140b175dc6f46b732fa22c74072c

Download Submit
memory/2092-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2092-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2092-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2092-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2092-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download