2729d1e6c24a0693ff21df333a2f3652fa12469dd2efa7737fbbc237aaa458ad

Analysis

max time kernel
110s
max time network
96s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2729d1e6c24a0693ff21df333a2f3652fa12469dd2efa7737fbbc237aaa458ad.exe
Size

83KB
MD5

aaa6097b1fc358fa95e88a88bea5b944
SHA1

c2e0c129a5faee05c610483c5fa83dfe2c125596
SHA256

2729d1e6c24a0693ff21df333a2f3652fa12469dd2efa7737fbbc237aaa458ad
SHA512

0cd0562a00e0071c5bb42ed2df5a99451d0ac65388a91b4810d002fbaa4e3338f6c595d6d6905aa07a002f84a6b9a01c34376d9a3bf18ccd03a67916c8401a39
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+oK+:LJ0TAz6Mte4A+aaZx8EnCGVuof

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2060-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2060-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000a000000012238-11.dat	upx
behavioral1/memory/2060-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2060-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2729d1e6c24a0693ff21df333a2f3652fa12469dd2efa7737fbbc237aaa458ad.exe

C:\Users\Admin\AppData\Local\Temp\2729d1e6c24a0693ff21df333a2f3652fa12469dd2efa7737fbbc237aaa458ad.exe
"C:\Users\Admin\AppData\Local\Temp\2729d1e6c24a0693ff21df333a2f3652fa12469dd2efa7737fbbc237aaa458ad.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-dRQhD0SQrP65IRFm.exe

Filesize
83KB

MD5
25ca0445a8a1dda5a545f17ad55e670a

SHA1
31557fd05f2999d86b8b2789f589ab93af6128d3

SHA256
1c57b9ac43d8edc7e26eb2f22a60a4ac355b3fde5aa39d802f3f61726357c147

SHA512
cf220d1acd7b4d2f8aaacd68c9263191bdac14cf8db7a06f4a53fa59d74bcf321873511d9c58215987665f507d6aad38e407051fc5580fe4e3809466352fb39c

Download Submit
memory/2060-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download