ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe
Size

83KB
MD5

03dd5c478a0dd7f09dac1f0af6687cce
SHA1

99be7f1132aa227cc1a5ed2d12721fdd7b224a05
SHA256

ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077
SHA512

e43dc02e0c3270fab0e0a2d2682286af6f110428d3563d96a989064db44f03bd3d422ba10010a9d43538d390ed4309abe864865c788e051646b21d0677f4aedf
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+lKK:LJ0TAz6Mte4A+aaZx8EnCGVulV

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2116-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2116-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2116-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2116-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2116-30-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe

C:\Users\Admin\AppData\Local\Temp\ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe
"C:\Users\Admin\AppData\Local\Temp\ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-RwasikGqVBJrdk5z.exe

Filesize
83KB

MD5
cdc265c711f9bd3559f2e512cd9566c2

SHA1
bdb700a169e7a41865cc7f96000e6119552c1ef2

SHA256
778ad6863ee2b66e2ed21361b180ffc485a71d39af59aa912f5e99cdffbaace0

SHA512
5ed584bebf4d1cb81b92cfaf2b63a2bd33ce2449cc30da65e3611b482f5f87d552480ff553e4bec2809b45748c79b57575123fb7cee524a97c6b940f5d466246

Download Submit
memory/2116-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2116-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2116-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2116-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2116-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2116-30-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download