ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7

Analysis

max time kernel
92s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe
Size

236KB
MD5

5f7bc2a547932f37d91a31072b50c39e
SHA1

a9a98b6582b67c18be192facce566248201eeec8
SHA256

ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7
SHA512

16114f9574197463fb05b359e049355a6daf9feb3d3a13b98cb618fe753a34bcbd19295141b11f7036421b6698d56a5a8e15f3098e2c382cc4e0f5d7db312fb1
SSDEEP

3072:TJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/A/FnncroP9P:VwDeM7iNEkgiOb31k1ECOJ/FP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2060-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0004000000013d08-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe

C:\Users\Admin\AppData\Local\Temp\ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe
"C:\Users\Admin\AppData\Local\Temp\ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-5A5sxhkmiKJlK9pf.exe

Filesize
236KB

MD5
6be4bb84fbfc632509344358852b2a1b

SHA1
2b194e6dd47df574e0cc0f41a0148387e57be520

SHA256
17e960783fc869f9d18fc0025ab9026a41af79e5473678cef1ada3c6d4c9ebf7

SHA512
3aa17832bcfb65e1af550e1524d7c7b73182c317384080e613b0210be84d7c6dc23c71ab0805a89a2b77db23a642d12a193241642257cebd68b6db42a8a23f58

Download Submit
memory/2060-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2060-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download