e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe
Size

83KB
MD5

5d3edca31c92e3c29d1d580714db1160
SHA1

b43b2a7c91a2271d7e669cd4780d9b0c9880f7ff
SHA256

e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660
SHA512

eab8351ff1a1f3961aca219e3f39da1c078789ee5e2fca0f31792506d984437e370e9268305236285fdd23caf2fff55d732bd060d524f0184786fec58aaa27c5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+5Kq:LJ0TAz6Mte4A+aaZx8EnCGVu5F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3028-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3028-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3028-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3028-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-13.dat	upx
behavioral1/memory/3028-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe

C:\Users\Admin\AppData\Local\Temp\e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe
"C:\Users\Admin\AppData\Local\Temp\e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-qoJrUvTx47VKIuvA.exe

Filesize
83KB

MD5
24a9741cfe93018aaa2bfcf543ae6c54

SHA1
6e338e2cf0e52dc286c78678690a86db5151619d

SHA256
ac7eeecdafd6fbeb076bf457465fd295861f80ca2c6126d086ee3b9fd980d119

SHA512
8871ad615052d39a8b48a193995e40b1eee887d158bcf5c6367583d2a81b426b2ea36636e9ed4fdc0407dea2267318a86734aac95bd4493c9679b593b33f1c1b

Download Submit
memory/3028-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3028-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3028-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3028-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3028-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download