fd84148426c6188c0bdec2e66d1f4fda9392342adb0c225d64aaacce24ce8653

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file_ (3).exe
Size

287KB
MD5

9b64fa84f1b815d909f4d4134ef2f077
SHA1

65da225d8393095f657f75eb16928408d2235048
SHA256

3f319c6679417445c6c1179eb0424b4446a6798acf61efc38c64de780ca64357
SHA512

b2b2fdfb03da6901f8cb01eb11a7ef1d8bc2757c1202fc14dcad492b7552ec3cdb81fcabc39632d3c1d4ec9ad130c38583f6995f8107816895e87620de875996
SSDEEP

6144:4F3LPSBCHorc1Z6LBkL2WhSbm2gfRtYwxpTxh+fwZZmqUEL79h:4F3WBrcRL2WJRtewnfP9h

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\eqvphba.tmp	acprotect

Loads dropped DLL 1 IoCs

Processes:

file_ (3).exe

pid process

4892 file_ (3).exe

pid	process
4892	file_ (3).exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\eqvphba.tmp	upx
behavioral32/memory/4892-7-0x0000000074F50000-0x0000000074F9F000-memory.dmp	upx
behavioral32/memory/4892-8-0x0000000074F50000-0x0000000074F9F000-memory.dmp	upx
behavioral32/memory/4892-9-0x0000000074F50000-0x0000000074F9F000-memory.dmp	upx
behavioral32/memory/4892-10-0x0000000074F50000-0x0000000074F9F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

file_ (3).exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file_ (3).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file_ (3).exe

C:\Users\Admin\AppData\Local\Temp\file_ (3).exe
"C:\Users\Admin\AppData\Local\Temp\file_ (3).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eqvphba.tmp

Filesize
59KB

MD5
3c7b09bcfaafbcfacc21ad6619e076e6

SHA1
874b5b527021486c7c76ef3956ea5e4f1f914263

SHA256
ce46ab0736fd5255ff14827501bdd806a9155550236d983f2ee89715f2f2918c

SHA512
0cd624cd4a5d046e2f3576f8dd448525c081b6a02a8780a52b16fc0c11a6bf77e9ed48ea9c70bc243693e56666475132c94c3077dd27f5ace7ac1bf31c846d81

Download Submit
memory/4892-7-0x0000000074F50000-0x0000000074F9F000-memory.dmp

Filesize
316KB

Download
memory/4892-8-0x0000000074F50000-0x0000000074F9F000-memory.dmp

Filesize
316KB

Download
memory/4892-9-0x0000000074F50000-0x0000000074F9F000-memory.dmp

Filesize
316KB

Download
memory/4892-10-0x0000000074F50000-0x0000000074F9F000-memory.dmp

Filesize
316KB

Download