02166b9f8e5344a35b0d0d3e7b2bf112d9a3cc996b53cee25d3ef432ceb51f78

Analysis

max time kernel
110s
max time network
93s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02166b9f8e5344a35b0d0d3e7b2bf112d9a3cc996b53cee25d3ef432ceb51f78.exe
Size

83KB
MD5

38d622c79e7fe0e958c4dc03a3597211
SHA1

72a0aa7f29aa3804b021856bf351988ad6841405
SHA256

02166b9f8e5344a35b0d0d3e7b2bf112d9a3cc996b53cee25d3ef432ceb51f78
SHA512

6a2ac1e96d0fed8ec4c1b9b6a6f446b3e0dbd41eae9e347f2cad95be6bcb3df3b6a019db44cf3db93fb9c55675127a7c324d6d9d69e725b739faacaced1b15e0
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dKO:LJ0TAz6Mte4A+aaZx8EnCGVudv

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1804-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1804-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1804-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1804-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1804-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02166b9f8e5344a35b0d0d3e7b2bf112d9a3cc996b53cee25d3ef432ceb51f78.exe

C:\Users\Admin\AppData\Local\Temp\02166b9f8e5344a35b0d0d3e7b2bf112d9a3cc996b53cee25d3ef432ceb51f78.exe
"C:\Users\Admin\AppData\Local\Temp\02166b9f8e5344a35b0d0d3e7b2bf112d9a3cc996b53cee25d3ef432ceb51f78.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-0l3Q5bPuOLtJY4vF.exe

Filesize
83KB

MD5
76fcb391de3616f2b88d98b7bce7fd66

SHA1
e820a6f98cca81c7dbc520511e46cd1edd1c5926

SHA256
9f425c0da147378e771ed0b3214f9a359e0da7a5bb3b584908b9f26c416fe01c

SHA512
35b325a5b58775803cc22b8ff6be10566a65667f43495cf0c1b0753414e2b4173d7905e7638660fd2e93f4ddb1adde11d4d785f38f0b3475bcd4929394697b63

Download Submit
memory/1804-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1804-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1804-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1804-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1804-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download