ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6

Analysis

max time kernel
119s
max time network
94s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe
Size

83KB
MD5

44bc36e861e78a97b6633f2e66972ed4
SHA1

3d5444116832e781470994d9d46b715b19d8eacf
SHA256

ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6
SHA512

a50930f4f7b13499abf38fc03f1c0ef12f2725c0cdb590e0b5badab848ff95256a768e26a88e6578188aa951f16a27aba76eb8b058b2bb20cf5dfc6c12bc258b
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vKu:LJ0TAz6Mte4A+aaZx8EnCGVuv/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2596-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2596-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2596-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2596-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2596-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe

C:\Users\Admin\AppData\Local\Temp\ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe
"C:\Users\Admin\AppData\Local\Temp\ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-5hBcWFp6PqssZvhI.exe

Filesize
83KB

MD5
c6fa338bd9e7c8903ff43175a1128d9e

SHA1
d7c7518e5b8a9911cf16e501808a88a80d654c11

SHA256
835aac0285c8f6f3cf06c47ed2daa6bbd12ce2bff45dfc81b5581debcf27ec86

SHA512
e6039695215406adeb0e4fa3cedc000e296fa3e88f55dbe1d7cfecc0697601d4afd562dadc258136af6803b8df874f2ff35907c3d9c6a8415de6f9bfef04844b

Download Submit
memory/2596-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2596-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2596-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2596-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2596-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download