2283a75d3ab26c435c0924adf7a591067e0f59cf0b39fd646516e94e5c236880

Analysis

max time kernel
119s
max time network
93s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/11/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2283a75d3ab26c435c0924adf7a591067e0f59cf0b39fd646516e94e5c236880N.exe
Size

83KB
MD5

ec47b2e3a439d4b1ba2df376fa7f6350
SHA1

ca00f5f5957901a39933d8a0652b2ac7667a709c
SHA256

2283a75d3ab26c435c0924adf7a591067e0f59cf0b39fd646516e94e5c236880
SHA512

a7872cdbec2b637569a758a6a32dc82a1080f25c7d942bb0fb9962cf18bee709fdc3072abc66c61194664485d742753b5c29c886a39b762f2383d602341eab54
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+fKu:LJ0TAz6Mte4A+aaZx8EnCGVuff

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1668-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1668-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1668-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1668-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2283a75d3ab26c435c0924adf7a591067e0f59cf0b39fd646516e94e5c236880N.exe

C:\Users\Admin\AppData\Local\Temp\2283a75d3ab26c435c0924adf7a591067e0f59cf0b39fd646516e94e5c236880N.exe
"C:\Users\Admin\AppData\Local\Temp\2283a75d3ab26c435c0924adf7a591067e0f59cf0b39fd646516e94e5c236880N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-S1MOLWVYyf4j42jJ.exe

Filesize
83KB

MD5
be64539a36b1bb5785f2d64c2ddb0ebc

SHA1
995ef631fa20cac9ca7edea2b0386d96632dcd4a

SHA256
96fc72554489666c85a9269a8ac2d258cf851f606c4d8f600b2c7fa55edfdfd7

SHA512
ab170db99923cfead07b02aed8ead89371a6adb948d25343b6450aa5977b4365e6486ffa51b7315517fff676d7847525433272405a4fd84c5e39d52de89ed165

Download Submit
memory/1668-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1668-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1668-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1668-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1668-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download