ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077

Analysis

max time kernel
140s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe
Size

83KB
MD5

03dd5c478a0dd7f09dac1f0af6687cce
SHA1

99be7f1132aa227cc1a5ed2d12721fdd7b224a05
SHA256

ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077
SHA512

e43dc02e0c3270fab0e0a2d2682286af6f110428d3563d96a989064db44f03bd3d422ba10010a9d43538d390ed4309abe864865c788e051646b21d0677f4aedf
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+lKK:LJ0TAz6Mte4A+aaZx8EnCGVulV

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4272-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4272-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4272-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4272-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023c7b-11.dat	upx
behavioral2/memory/4272-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4272-19-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4272-27-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe

C:\Users\Admin\AppData\Local\Temp\ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe
"C:\Users\Admin\AppData\Local\Temp\ebe86d30c436610aadb5fe5cba35c1683154a305a875a2a66b3cf89446779077.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Gg6rWOAoB20FnpKR.exe

Filesize
83KB

MD5
24102480c3b2416961f03bfc55bafc13

SHA1
1f937b1195a6d40ee1edf89b5bab8aec057a7bc5

SHA256
1758d0759be031d7430b6a874bef2ce788869aaa5a95b58a3bd594c40cf0cb24

SHA512
109210206c408fddac74b8e95472f989d06e7fafd2e34cb2bfb9e8614436cc32750280578a58b4d92a5aac73cda30c0d1ce25c7f5f0d35fba9aba593f42573c6

Download Submit
memory/4272-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4272-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4272-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4272-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4272-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4272-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4272-27-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download