57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe
Size

83KB
MD5

139ebebd6befaf6536a09b327e05d0c0
SHA1

8a84f45aefa6e15772698a37a5e9dcbef9a83974
SHA256

57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1
SHA512

cdbfefa77e23167c28b4e9f2c294c25990152a0a677034bc517c3f2c1350daefe375acce84b739696c6a26ff6a9a5aa3c789009cba1125ab435345ac605a37b0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bKn:LJ0TAz6Mte4A+aaZx8EnCGVuby

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2576-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2576-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2576-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000b000000023b91-12.dat	upx
behavioral2/memory/2576-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2576-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe

C:\Users\Admin\AppData\Local\Temp\57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe
"C:\Users\Admin\AppData\Local\Temp\57c0a335c4f7b211e87e632bc00998e9326464d719b668b44272089521aea5a1N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-d3uADr6slfM2vvww.exe

Filesize
83KB

MD5
0b29cae86ae214c620032cc1da652c21

SHA1
1cc67dfcd63a4c8115af581a0da548a7ac6e89bb

SHA256
badb568ef4ffa038ec5af0e1ef2010dcacafc41186537a8d2ef20eaa9e89680a

SHA512
6d6b3ee4d93f3948d022afbf07366921640a3f1f86fdd6d173616051d942453bbe1985527043a9355b62667cc65ffbcb63ff28c56dadaf90f40542820a85c0bf

Download Submit
memory/2576-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2576-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2576-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2576-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2576-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download