cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe
Size

83KB
MD5

c664becd5a4e75aece02c2feee7ec970
SHA1

9b2614f3378f30ff766e44fa5618f925ede4f1fd
SHA256

cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1
SHA512

d5e0cab519e2b6356e5c853d3ee378316a8a9bb322d673977e03b99bc1d80a32fa077ecd97c8b45708c08529fd10171dc75c3312e1ad0f3ff80a638dd34e6de3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+jKa:LJ0TAz6Mte4A+aaZx8EnCGVujt

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3036-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3036-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/3036-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3036-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3036-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe

C:\Users\Admin\AppData\Local\Temp\cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe
"C:\Users\Admin\AppData\Local\Temp\cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-bHSIi9AnXnEYfe1l.exe

Filesize
83KB

MD5
48ca79a28e6f5d576505d002f50556f8

SHA1
6ff2aeb6b9c850652fdbbef2a4dc67d632e273be

SHA256
b368aa57e42c46df3b6049aaebcdda996611ac1ea20bd8b4d199f486364e90ee

SHA512
ed8d80650b693b5e42f89d3122f1e2938d2e6bbdbccc97fd995bfad3f74a7723aff9fe4f09f0a8c022d1565c6f8cc5e17a27ce61a2754f72394cbc6fd43e2e22

Download Submit
memory/3036-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3036-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3036-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3036-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3036-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3036-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download