381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b

Analysis

max time kernel
111s
max time network
98s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe
Size

83KB
MD5

556fe9185a0f2656f6457d8a8d7bdc2c
SHA1

1fa0d0b2b36594d7c4ba0528203a7eb86b41de1c
SHA256

381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b
SHA512

c87340cfa4fcc9617d8b2770535916e94fd0a3b06412d9f231dac8ba9ea91dade05c8a0eea350b159aea6c0bca0abd2f0b26ea0fc85a5c3eb2dc2007e5913519
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK+:LJ0TAz6Mte4A+aaZx8EnCGVuAn

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2904-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2904-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2904-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\rifaien2-LMqnYQAyo1n8Pd41.exe	upx
behavioral1/memory/2904-16-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2904-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe

C:\Users\Admin\AppData\Local\Temp\381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe
"C:\Users\Admin\AppData\Local\Temp\381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-LMqnYQAyo1n8Pd41.exe

Filesize
83KB

MD5
8d325adb3c95d88cf98d99a23d1b1825

SHA1
e05ec04d5678af0333f290cd1a79bd988984b6f9

SHA256
2b9fa88371e3f4a793c5f3e6ee92e28ba820cfe0f53b83d2e55f99836a0c64da

SHA512
a44ea3cea31eaa0fc89778930807c4a42794b5ef48c10c0af486a9c6125b6b28338f27bc05593fe55561afb72b82cf633a48d5d0eead683bdf4c262c2fa627e1

Download Submit
memory/2904-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2904-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2904-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2904-16-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2904-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download