1e03abe57c5fc9a9d75011c83761680cb7004c1fae6ccf303b4d4a524469922c

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e03abe57c5fc9a9d75011c83761680cb7004c1fae6ccf303b4d4a524469922cN.exe
Size

83KB
MD5

0f6f5274489e7b47c40acddeafc564f0
SHA1

0667bb29cc307d7f5df781f4e5f13a81e35e4a44
SHA256

1e03abe57c5fc9a9d75011c83761680cb7004c1fae6ccf303b4d4a524469922c
SHA512

804f7e2cdd3109d90c05aaf0dbe16c6674662d89faaa62b21f043fbcdee553db35a66f44c90e55e0a9ff3a6d88a0cd740b99899c950884c671ed28e7f684f504
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+XK:LJ0TAz6Mte4A+aaZx8EnCGVuX

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2180-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2180-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2180-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2180-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000b000000023b88-12.dat	upx
behavioral2/memory/2180-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2180-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e03abe57c5fc9a9d75011c83761680cb7004c1fae6ccf303b4d4a524469922cN.exe

C:\Users\Admin\AppData\Local\Temp\1e03abe57c5fc9a9d75011c83761680cb7004c1fae6ccf303b4d4a524469922cN.exe
"C:\Users\Admin\AppData\Local\Temp\1e03abe57c5fc9a9d75011c83761680cb7004c1fae6ccf303b4d4a524469922cN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-srxEDQOLYYkC6ydy.exe

Filesize
83KB

MD5
0084115e181b86c9f6bbec68a81852f2

SHA1
21abe1adf64bedcb24386d48a53c8dc9d297a93b

SHA256
0c3d2dcf0fb8d48a1f98d520d032a3f70f72ad99753556049276c13c5de70a65

SHA512
2d21c006b2710ac2856d869bc121c45f95f30f82e630078698cd77e68f508b9f7295b30f8e6fdcb932762ce87b9769ac4347076306ce59d43c1bb9c3c160364b

Download Submit
memory/2180-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2180-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2180-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2180-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2180-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2180-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download