5e25e898af7c46e975ee861da455046b766c2f13a8edca239a016b38ad4b2e3e

Analysis

max time kernel
111s
max time network
95s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e25e898af7c46e975ee861da455046b766c2f13a8edca239a016b38ad4b2e3e.exe
Size

83KB
MD5

5785c2252b7e3d302cdd98395b85c052
SHA1

1ce0b459d8b266d3d22a69ee57971c497a8c39da
SHA256

5e25e898af7c46e975ee861da455046b766c2f13a8edca239a016b38ad4b2e3e
SHA512

26250875ee14245430d51e7eb6aca64eeed68a2519ed2b8e3fdf199208b781fa725be098378f1abac2ae3f834ae8ccc566c6903b652dcad9e534e20b923c766d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bKa:LJ0TAz6Mte4A+aaZx8EnCGVub/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2388-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2388-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2388-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0004000000018334-11.dat	upx
behavioral1/memory/2388-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2388-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e25e898af7c46e975ee861da455046b766c2f13a8edca239a016b38ad4b2e3e.exe

C:\Users\Admin\AppData\Local\Temp\5e25e898af7c46e975ee861da455046b766c2f13a8edca239a016b38ad4b2e3e.exe
"C:\Users\Admin\AppData\Local\Temp\5e25e898af7c46e975ee861da455046b766c2f13a8edca239a016b38ad4b2e3e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Qc0mVqnxOg4m0zyy.exe

Filesize
83KB

MD5
1f93b85bb61c0a0564414480522ad32b

SHA1
9d2f9fe5667e1397cfaa0f4b35e97429dd7449ed

SHA256
465c5b4a4f6a2cf1be6429035e12b75fb848e6758a52e8fa0b2ae37200b20778

SHA512
c33a52d5265a798cf5084ebf8ca4b6b7be16add171196e4127f111adf4624b0c2d8d224144e74811fc9005bf7c66c6a35a295dcbf2c0aa9ef82491067cc4dc85

Download Submit
memory/2388-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2388-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2388-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2388-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2388-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download