d850b6cc6cf47e4873937b6a04dafa2ef4de57b7009de314c6dadde6a591ab65

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d850b6cc6cf47e4873937b6a04dafa2ef4de57b7009de314c6dadde6a591ab65.exe
Size

83KB
MD5

4c3955f84d4235e4a4b1d1f43cbc5ce0
SHA1

1a963fac0321f5b9974eabcf0e7bced89375ab72
SHA256

d850b6cc6cf47e4873937b6a04dafa2ef4de57b7009de314c6dadde6a591ab65
SHA512

cc4ff9ada9999c1a78f4b03720cdb8f4c2a4f19cafd4ac17a640653c2c8a0df3e7747814a36fa68e41e7ef3cab797c794306851e7129095c1f6ac92703fd9be6
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KKO:LJ0TAz6Mte4A+aaZx8EnCGVuKP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2196-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2196-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000a0000000120f9-11.dat	upx
behavioral1/memory/2196-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2196-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d850b6cc6cf47e4873937b6a04dafa2ef4de57b7009de314c6dadde6a591ab65.exe

C:\Users\Admin\AppData\Local\Temp\d850b6cc6cf47e4873937b6a04dafa2ef4de57b7009de314c6dadde6a591ab65.exe
"C:\Users\Admin\AppData\Local\Temp\d850b6cc6cf47e4873937b6a04dafa2ef4de57b7009de314c6dadde6a591ab65.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-dN1l9aNeeckZloVZ.exe

Filesize
83KB

MD5
582d45b26693418ee66d3b63f6a23c8f

SHA1
e4b7e8058dabfa73c8e49a8b02e3a9c122582fbd

SHA256
22e1dc12694470c5449dc678861bc1479fd0b6bfdd8031a8259978cc9760f3f6

SHA512
191db6dd11e5c3a308033238e85dca2d207332e8521f5be0e0db8d81fe207c1038063dbe75b3ed6780a3da8ae0a42046af8e39bab8bf9f35d935dbc1d6b70915

Download Submit
memory/2196-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2196-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2196-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2196-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2196-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download