57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1

Analysis

max time kernel
110s
max time network
91s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe
Size

83KB
MD5

139ebebd6befaf6536a09b327e05d0c0
SHA1

8a84f45aefa6e15772698a37a5e9dcbef9a83974
SHA256

57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1
SHA512

cdbfefa77e23167c28b4e9f2c294c25990152a0a677034bc517c3f2c1350daefe375acce84b739696c6a26ff6a9a5aa3c789009cba1125ab435345ac605a37b0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bKn:LJ0TAz6Mte4A+aaZx8EnCGVuby

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1760-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1760-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x00090000000120fe-11.dat	upx
behavioral1/memory/1760-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1760-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe

C:\Users\Admin\AppData\Local\Temp\57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe
"C:\Users\Admin\AppData\Local\Temp\57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-LQO87K6EFp1G7GjZ.exe

Filesize
83KB

MD5
719d3d45f75e584c3101bb70c1d3114d

SHA1
b7b0dfeeef763b506a72f495c7710946f81a01ca

SHA256
67c0af61c21c518cd1005541a77db19b9a06355f23e61587d6bbf5dc26a6954b

SHA512
6c83a5452ed4c850e1072ca1824e51cf5a2a1d36523e4abe189ad778ce5ce4a6f79030af8554b8557edf16667eb3b4d23f15bf23ebedd1fc805f3effb2273dfd

Download Submit
memory/1760-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download