4b5b60a000be89ad1f9bc49f3b8f2a0a8d26d58360bbffbfcba2bde19c42c96e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b5b60a000be89ad1f9bc49f3b8f2a0a8d26d58360bbffbfcba2bde19c42c96e.exe
Size

83KB
MD5

6bc4784b2fb98bc81dfc4376d4cf2433
SHA1

f89766472a3f75cbc3545c472166d91253486a82
SHA256

4b5b60a000be89ad1f9bc49f3b8f2a0a8d26d58360bbffbfcba2bde19c42c96e
SHA512

6106cba2d8ae5ed00fcfaf69bfe5b9620e8c0c7858eb50e22c30e078aa700774715ad81a6e5d7626d4659e24e08e27cc2b91be46c42fae7b5b7e435906743003
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+UKO:LJ0TAz6Mte4A+aaZx8EnCGVuUP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2672-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2672-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2672-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2672-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2672-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b5b60a000be89ad1f9bc49f3b8f2a0a8d26d58360bbffbfcba2bde19c42c96e.exe

C:\Users\Admin\AppData\Local\Temp\4b5b60a000be89ad1f9bc49f3b8f2a0a8d26d58360bbffbfcba2bde19c42c96e.exe
"C:\Users\Admin\AppData\Local\Temp\4b5b60a000be89ad1f9bc49f3b8f2a0a8d26d58360bbffbfcba2bde19c42c96e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Z5sOBbCEN6ZcMoA5.exe

Filesize
83KB

MD5
206b20b98ac8d9706d610a4516da3f05

SHA1
57fefe2bdf5dc3b244e23b6406cdc3829d2ba7c7

SHA256
87f44242290272865908482c0a8df7de1e2bd20e79ac4462e8fa561142239205

SHA512
6d62c9f0e7f1a2ec1b7bbef5ffce4e5ebc27e47bd7563550f87cdfc2b238f2e0cee1124f4c2f99f2bc4bcec828b7ae53e41406b14ba8a57361be37452bf38376

Download Submit
memory/2672-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2672-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download