98ecb98c4f6cfa8b21e0b0c150b9e8bafab752bb3c9aba48ea6ca522bef87b9c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98ecb98c4f6cfa8b21e0b0c150b9e8bafab752bb3c9aba48ea6ca522bef87b9cN.exe
Size

83KB
MD5

87249b5556edf0fae8fef738dbc03770
SHA1

56d85afe7e58b2e02b72d8ef3cd7e5b9cb65751c
SHA256

98ecb98c4f6cfa8b21e0b0c150b9e8bafab752bb3c9aba48ea6ca522bef87b9c
SHA512

089d85b842bb57d47710d5ac22c64015b24971974afb0ad21bde7ab294b4c90550c16b3e8d963965c9344de461fcd159ea5405bb91b3868eae18ca2944361258
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/KO:LJ0TAz6Mte4A+aaZx8EnCGVu/P

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2412-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2412-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2412-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/2412-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2412-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98ecb98c4f6cfa8b21e0b0c150b9e8bafab752bb3c9aba48ea6ca522bef87b9cN.exe

C:\Users\Admin\AppData\Local\Temp\98ecb98c4f6cfa8b21e0b0c150b9e8bafab752bb3c9aba48ea6ca522bef87b9cN.exe
"C:\Users\Admin\AppData\Local\Temp\98ecb98c4f6cfa8b21e0b0c150b9e8bafab752bb3c9aba48ea6ca522bef87b9cN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-x7wUyXFtK7Z6NXoD.exe

Filesize
83KB

MD5
6f97b21703234e623967638e9b659dcd

SHA1
4f62c1f606ca52ce9b337168d6d1ebe6b7f05a03

SHA256
340747d163ab613dc60ecce7f63d60317f42f200609253ba6b7e0f163d33b945

SHA512
f94827937fa7f1d64e099ea388dde8ead12775b3fc3ab40bb5d184a51a2bd902f5d7bf5bc7afc0b055d1206fe98901b7ce8dd0e3dcacb2db6e5447a8342ea3e9

Download Submit
memory/2412-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2412-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2412-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2412-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2412-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download