c9862731dd3aa7acfe6253bc76f4d21916c636c318da224d63010c8414099a90

Analysis

max time kernel
110s
max time network
91s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9862731dd3aa7acfe6253bc76f4d21916c636c318da224d63010c8414099a90N.exe
Size

83KB
MD5

ee1638bafe42dc905be00b7c99b7f5a0
SHA1

c1571f57619e3cac12fdad0994eab19b97229f8a
SHA256

c9862731dd3aa7acfe6253bc76f4d21916c636c318da224d63010c8414099a90
SHA512

c51e00e124522b1363acf12da28567e0f7c8e2662c713dada98411be2f00964c10273c65f5ebae39605f143b8c57f5f60eba7c234600dc94bf95627c3e43baa5
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+gK6:LJ0TAz6Mte4A+aaZx8EnCGVugd

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2112-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2112-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-12.dat	upx
behavioral1/memory/2112-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2112-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9862731dd3aa7acfe6253bc76f4d21916c636c318da224d63010c8414099a90N.exe

C:\Users\Admin\AppData\Local\Temp\c9862731dd3aa7acfe6253bc76f4d21916c636c318da224d63010c8414099a90N.exe
"C:\Users\Admin\AppData\Local\Temp\c9862731dd3aa7acfe6253bc76f4d21916c636c318da224d63010c8414099a90N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-0DOGHuyQuTLPS3UN.exe

Filesize
83KB

MD5
d533a46bf9656f9fe73996f39d69e081

SHA1
4517e1bda4e424741f60f51b66f50ba5e2d7bb39

SHA256
615f1f8f400797305d76ce187e1d20c0447f6efd95e296d3b1d95d0a727700d9

SHA512
19853d71e7a0a187d162e976e0e6239bd3d846a71d0d0e21888628aaac5a84485636d29fb850b34f04f9698b5b2d29f42024758c79010f80d40bf987a2281647

Download Submit
memory/2112-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download