46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe
Size

83KB
MD5

965601a029d952b46e410e1e651cbc4f
SHA1

654b3d23f3ab17ed698d14b31edd30aa653d2bbf
SHA256

46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2
SHA512

3057ec3f64bcfdcf95487387cffaf1b7ec5b15f8a4ae53b20fc848406806c63bd9c085160c18fbb8083b3a7e14a686f225c03930931161a8e8f28700d059d642
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+LK6:LJ0TAz6Mte4A+aaZx8EnCGVuLd

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3552-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3552-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3552-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3552-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023c98-12.dat	upx
behavioral2/memory/3552-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3552-18-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3552-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe

C:\Users\Admin\AppData\Local\Temp\46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe
"C:\Users\Admin\AppData\Local\Temp\46c4e27bda3737c69aa31cfca425c3b90191e23c444bb24da7080d389938aec2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-1sTVOi91RhVQatzX.exe

Filesize
83KB

MD5
957d642ec8035b1fefa4f44f252d02e2

SHA1
3bd5f770fa138a88b895fe68f4001c9184d7d4c1

SHA256
e843ee30d93cd3f7b758a8cd0a584117232389aca15f3da4f1123ca1b049719e

SHA512
07cb4ff878dfb12d567477edd5958ab6443f62746dd096e6b2e9e54134e83569727d062e9e1f5731f117d9f8d3a08449843c356aa125093dd63d3fd572ec44c1

Download Submit
memory/3552-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3552-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3552-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3552-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3552-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3552-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3552-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download