381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b

Analysis

max time kernel
110s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe
Size

83KB
MD5

556fe9185a0f2656f6457d8a8d7bdc2c
SHA1

1fa0d0b2b36594d7c4ba0528203a7eb86b41de1c
SHA256

381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b
SHA512

c87340cfa4fcc9617d8b2770535916e94fd0a3b06412d9f231dac8ba9ea91dade05c8a0eea350b159aea6c0bca0abd2f0b26ea0fc85a5c3eb2dc2007e5913519
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK+:LJ0TAz6Mte4A+aaZx8EnCGVuAn

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3544-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3544-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3544-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3544-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\rifaien2-0Dhw8bb7ibCWvXZB.exe	upx
behavioral2/memory/3544-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3544-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe

C:\Users\Admin\AppData\Local\Temp\381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe
"C:\Users\Admin\AppData\Local\Temp\381ae84e0900a32313138a126d08bbd8850708108d5216b5587b5a712b56292b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-0Dhw8bb7ibCWvXZB.exe

Filesize
83KB

MD5
af732c37b5c6bdc3b198d579d872194a

SHA1
8074e2936cb3f23b5026be31d3baa5eb60fd25e1

SHA256
97f652ae47cafcc7e53a3e86f7005f42bc843771078e7caf3f3d60b2da7211c1

SHA512
4f24e518eefc30a864af4a7a8938c2a239fa49ce86db4ea7cc47ef50d54841d28109f374a39d26c6509f3f46f40f8819574f64b66c280f92a52828024dbf3b6b

Download Submit
memory/3544-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3544-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3544-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3544-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3544-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3544-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download