56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abb

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe
Size

236KB
MD5

5a8c27889b2df9e6d9f4b798367489b0
SHA1

a1d44f0b17c6889e44415eae5056ee8b6074b556
SHA256

56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abb
SHA512

e3b6f9cbb72f46fa0108af8f4b5829d3dc4fd80b7153e8586f6a6f649bfd388e5ac2b2967b2695a7ca280a467e21297ac8bbfedb83819448f31aa17f60c5050f
SSDEEP

3072:0J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/I/FnncroP9:4wDeM7iNEkgiOb31k1ECWJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2992-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2992-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0008000000023ca9-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe

C:\Users\Admin\AppData\Local\Temp\56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe
"C:\Users\Admin\AppData\Local\Temp\56a6f5d4bf0d52b6eef16a8e5875de46c75d85663f9a3e56aacef1552f843abbN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-yFK9qLi9WHDMj3N1.exe

Filesize
236KB

MD5
df422a237237d8eb29500a9cda6528f6

SHA1
3160a7401ed9353a869b53353cebb9b1f63ba4ba

SHA256
705e3493355cb6c09abcc4e487a0b541230f18179e147f650c269a8f148581e1

SHA512
523a921fcbd214184bf378fbc0fa2a98ec79ec79a741915b055e0e6b51be66bf0fe780eed947a6dc4467a3bd6840290212425601cb33b6ad5c75e10eb43ffedb

Download Submit
memory/2992-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2992-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download