e84e3adfc2cac3428b9d35602f057ad28611df6d78abdb8eedc9c51de49c2c7e

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e84e3adfc2cac3428b9d35602f057ad28611df6d78abdb8eedc9c51de49c2c7eN.exe
Size

83KB
MD5

fb8bb46d7eb59cae1451aff480c293d0
SHA1

7675785a18b85fc87c8d963219faad9ff92a44dc
SHA256

e84e3adfc2cac3428b9d35602f057ad28611df6d78abdb8eedc9c51de49c2c7e
SHA512

2916a85b367f01773c3b87e8fa7b7afb86358cafa5348b1d1a6dfa99fc6167897f6c6860b9e7cf5d995b8e11493e12b6ef4429a7dd322385e9cac3f08fc3863c
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AKK:LJ0TAz6Mte4A+aaZx8EnCGVuAV

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5036-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5036-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5036-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5036-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023c88-11.dat	upx
behavioral2/memory/5036-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5036-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e84e3adfc2cac3428b9d35602f057ad28611df6d78abdb8eedc9c51de49c2c7eN.exe

C:\Users\Admin\AppData\Local\Temp\e84e3adfc2cac3428b9d35602f057ad28611df6d78abdb8eedc9c51de49c2c7eN.exe
"C:\Users\Admin\AppData\Local\Temp\e84e3adfc2cac3428b9d35602f057ad28611df6d78abdb8eedc9c51de49c2c7eN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-cAMFonzD3Ly6SWwT.exe

Filesize
83KB

MD5
9ee72e3bce8f73b18389afa1ce5a73ba

SHA1
416a2ddaad20d319c17966df68ff2fe3b298852d

SHA256
eaade987f05fa91de7712e69079059c100508f76f59def1a94398e9fb8db071b

SHA512
1716e6595b2dbb47acf028c3f923a15f52dd3100d6af093606db6c75fab7f2cff461908165bbca551b62bd67007e78a14e2ce91e57563a8ca14aade4c131d49f

Download Submit
memory/5036-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5036-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5036-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5036-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5036-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5036-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download