46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2

Analysis

max time kernel
110s
max time network
94s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe
Size

83KB
MD5

965601a029d952b46e410e1e651cbc4f
SHA1

654b3d23f3ab17ed698d14b31edd30aa653d2bbf
SHA256

46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2
SHA512

3057ec3f64bcfdcf95487387cffaf1b7ec5b15f8a4ae53b20fc848406806c63bd9c085160c18fbb8083b3a7e14a686f225c03930931161a8e8f28700d059d642
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+LK6:LJ0TAz6Mte4A+aaZx8EnCGVuLd

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2868-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2868-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2868-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe

C:\Users\Admin\AppData\Local\Temp\46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe
"C:\Users\Admin\AppData\Local\Temp\46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-MsVmTm44FoXXrSV5.exe

Filesize
83KB

MD5
9d88e358f14026514c85768726c90901

SHA1
64b33e2a211d9050994855396909eca1794fcd28

SHA256
76a7e35d205e5161dbd5a90dae6c54ecaf23896e3989c330606ff4b701c4ef1a

SHA512
10d34fb93e15383ab9b52c5ffbfe52b780983743bcdc2ac0227769254be3d782ccebc6017a202be8d0003c407ae0e7d5fe0202009af71caeb1e04b4c87b71851

Download Submit
memory/2868-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2868-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2868-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2868-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download