ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6

Analysis

max time kernel
110s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe
Size

83KB
MD5

44bc36e861e78a97b6633f2e66972ed4
SHA1

3d5444116832e781470994d9d46b715b19d8eacf
SHA256

ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6
SHA512

a50930f4f7b13499abf38fc03f1c0ef12f2725c0cdb590e0b5badab848ff95256a768e26a88e6578188aa951f16a27aba76eb8b058b2bb20cf5dfc6c12bc258b
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vKu:LJ0TAz6Mte4A+aaZx8EnCGVuv/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/64-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/64-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/64-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/64-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000b000000023b79-12.dat	upx
behavioral2/memory/64-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/64-18-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/64-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe

C:\Users\Admin\AppData\Local\Temp\ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe
"C:\Users\Admin\AppData\Local\Temp\ea88515f2a4abe5ad634f826230444b13976391851c23e9d583d1b03f1a25fa6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-3KgyOKJCaAvyl4q8.exe

Filesize
83KB

MD5
cdd1f9b6e369bb17b288c950939c10fc

SHA1
b3b2246d504d1f609c59514da0d1446dc3745c9c

SHA256
07720ed45cca7ae8a21972e6c60eaf51e61cafcbc04b5863c9ee648b520f2e8a

SHA512
2ec49fa1e5db9ba278871f43cadd42c25a00cb0feaf636bc2aa95bac62e2afbd53d30b96b5410cdad60e1286e034e204368b0d38d4f8a7e584dd00c4a38a5da6

Download Submit
memory/64-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/64-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/64-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/64-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/64-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/64-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/64-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download