e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660

Analysis

max time kernel
111s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe
Size

83KB
MD5

5d3edca31c92e3c29d1d580714db1160
SHA1

b43b2a7c91a2271d7e669cd4780d9b0c9880f7ff
SHA256

e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660
SHA512

eab8351ff1a1f3961aca219e3f39da1c078789ee5e2fca0f31792506d984437e370e9268305236285fdd23caf2fff55d732bd060d524f0184786fec58aaa27c5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+5Kq:LJ0TAz6Mte4A+aaZx8EnCGVu5F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4540-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4540-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4540-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4540-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-12.dat	upx
behavioral2/memory/4540-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4540-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe

C:\Users\Admin\AppData\Local\Temp\e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe
"C:\Users\Admin\AppData\Local\Temp\e48a2500301d79750437119f2eb4e92d15d876d9dbcc56a8ab4d655eb9444660N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-6lfm1ZVsVqMCAUlG.exe

Filesize
83KB

MD5
cb196b72aafa64cb7973ae7c1afe5c58

SHA1
70d1ec727f58c0b3a185c339dba5e29347dea4f4

SHA256
8cd5b25db717cda405ea59802291382bc3fcddf543b380c721c6b347858ab60f

SHA512
59e0fb44c3e7f04796ccb39ada60754791af31214a3dbca49b6502c59801110687223433c340c7c48325b868d6b4474a4bee010988e0a5ca88f7d1ed59296f1d

Download Submit
memory/4540-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4540-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4540-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4540-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4540-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4540-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download