cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe
Size

83KB
MD5

c664becd5a4e75aece02c2feee7ec970
SHA1

9b2614f3378f30ff766e44fa5618f925ede4f1fd
SHA256

cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1
SHA512

d5e0cab519e2b6356e5c853d3ee378316a8a9bb322d673977e03b99bc1d80a32fa077ecd97c8b45708c08529fd10171dc75c3312e1ad0f3ff80a638dd34e6de3
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+jKa:LJ0TAz6Mte4A+aaZx8EnCGVujt

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1620-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1620-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1620-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x000300000001e746-12.dat	upx
behavioral2/memory/1620-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1620-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1620-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe

C:\Users\Admin\AppData\Local\Temp\cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe
"C:\Users\Admin\AppData\Local\Temp\cf91d63be7a09b5b9bb6485c96330cc5891d7a4d88c6f02af633791460ad05e1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-Kae0xqchvcB3ez9N.exe

Filesize
83KB

MD5
4d14c3522a90551314581e6df58734d6

SHA1
9215c9bdace580ab0effbd2020e152140d9c7b5b

SHA256
82014c4daa676ed7f457f21f7f321a938ed1d206665584b7ce28df2772ffc930

SHA512
801d5ab25839a5a349a187b73ecde6bc43c1522aa2703ff0ac8c960cc93ae983f23cc7acfac96604c33642e80cdd228f7d942b798c5df93a4032bbe5d9a3e677

Download Submit
memory/1620-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download