ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7

Analysis

max time kernel
96s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe
Size

236KB
MD5

5f7bc2a547932f37d91a31072b50c39e
SHA1

a9a98b6582b67c18be192facce566248201eeec8
SHA256

ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7
SHA512

16114f9574197463fb05b359e049355a6daf9feb3d3a13b98cb618fe753a34bcbd19295141b11f7036421b6698d56a5a8e15f3098e2c382cc4e0f5d7db312fb1
SSDEEP

3072:TJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/A/FnncroP9P:VwDeM7iNEkgiOb31k1ECOJ/FP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4912-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4912-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000300000001e742-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe

C:\Users\Admin\AppData\Local\Temp\ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe
"C:\Users\Admin\AppData\Local\Temp\ac12494a3f24780cecd27e5e80e7bc6e79c14ce89b9eacc2af5fda261acb6af7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-gMxi3xEfzt3NoGGR.exe

Filesize
236KB

MD5
d1ac87448bb1c4610a2300b4a5008ce3

SHA1
94b550a1e590ca91d5c50866bd87d0bbe99aec1e

SHA256
3a12d1c2080fbaff634fc52f400be20b3faf18d44f611abf94b466ad2c439406

SHA512
79aa728af8a11b55fe8b6aed1561fce2bd80a9e35c2d37c367067b1532bd78ca20038b1247edb73076c3740091ab5d768ec06efa58e5441ae193c992217de6a0

Download Submit
memory/4912-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4912-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download