56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abb

Analysis

max time kernel
91s
max time network
92s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe
Size

236KB
MD5

5a8c27889b2df9e6d9f4b798367489b0
SHA1

a1d44f0b17c6889e44415eae5056ee8b6074b556
SHA256

56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abb
SHA512

e3b6f9cbb72f46fa0108af8f4b5829d3dc4fd80b7153e8586f6a6f649bfd388e5ac2b2967b2695a7ca280a467e21297ac8bbfedb83819448f31aa17f60c5050f
SSDEEP

3072:0J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/I/FnncroP9:4wDeM7iNEkgiOb31k1ECWJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2296-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x00090000000120fe-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe

C:\Users\Admin\AppData\Local\Temp\56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe
"C:\Users\Admin\AppData\Local\Temp\56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-3nwIddKIjUFo1g1f.exe

Filesize
236KB

MD5
f2ad54c3881385b4ce4481720d0ccf30

SHA1
22a475d057d0cfbf167dcaa679701a0a35b72f9b

SHA256
d2cc7c43ce63dee6aea2a95b8e383e8fe720bf0e13d6f5dd029d0a4f7cd66b9e

SHA512
a3c9a1d8c68b81d637d937094ff5a2dbbb302af4762d62290c34011b92b206615d404625167e3ad00d3ff987433fcaf62ef4b80687ba83b32ada33c589b997fd

Download Submit
memory/2296-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2296-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download