e8db949a98231ec1c1448cc3ff1455e3962e283b732c170fbc419d62991bf185

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8db949a98231ec1c1448cc3ff1455e3962e283b732c170fbc419d62991bf185N.exe
Size

83KB
MD5

955d3b2cdf6279b3e4ae178d559cc4a0
SHA1

a208e5686b9899a4c6fa3782a94e0c7c1e1fe3cd
SHA256

e8db949a98231ec1c1448cc3ff1455e3962e283b732c170fbc419d62991bf185
SHA512

9bc0abb447863c26289d33561dd8fea166c3c61c7bb3f1f948733ea5a9e1e0170b340d6d9d4b06a14be85edef7b098508e53d1bf31e4992611bdb82161ba9793
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK6:LJ0TAz6Mte4A+aaZx8EnCGVued

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2392-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2392-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-13.dat	upx
behavioral1/memory/2392-16-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2392-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8db949a98231ec1c1448cc3ff1455e3962e283b732c170fbc419d62991bf185N.exe

C:\Users\Admin\AppData\Local\Temp\e8db949a98231ec1c1448cc3ff1455e3962e283b732c170fbc419d62991bf185N.exe
"C:\Users\Admin\AppData\Local\Temp\e8db949a98231ec1c1448cc3ff1455e3962e283b732c170fbc419d62991bf185N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-wKl3wj0mUjKSYIet.exe

Filesize
83KB

MD5
278e51abe0c847427ade8d29342ceca5

SHA1
e90f1f80360f3b91b36601c81837427a7614d49a

SHA256
ae40752f542ff59184012d5f270a86fa075a812cdf6fd9aa275cd8848bb8c638

SHA512
e85a3c6ad3099ab46e8b36172e441370054a410f6dc60fd4aa9f4c61ce306bff34e01d209e3e6959fd5d90b23866e22d42f2b6e928d6e7ee6d67d4f602345e21

Download Submit
memory/2392-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2392-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2392-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2392-16-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2392-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download