f1c4541f5263d00f53859a05cb9abf83c012567eaa9c14ade29757832d4dd633

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1c4541f5263d00f53859a05cb9abf83c012567eaa9c14ade29757832d4dd633N.exe
Size

83KB
MD5

62e1b032ad0a6232a58ed8742f968990
SHA1

6105661081b4a4b573f32280d0f7e8e6091832d3
SHA256

f1c4541f5263d00f53859a05cb9abf83c012567eaa9c14ade29757832d4dd633
SHA512

4a26b63feda50a967712ceeb13b904d23fb17543c82d07a69cb17bc6ca62defa20b9cfd60db1c60fa8a5b804dbced04dbb1054855f70e4bf92cf122a60ff031d
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+mK6:LJ0TAz6Mte4A+aaZx8EnCGVum9

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2328-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2328-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000a00000001225f-11.dat	upx
behavioral1/memory/2328-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2328-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1c4541f5263d00f53859a05cb9abf83c012567eaa9c14ade29757832d4dd633N.exe

C:\Users\Admin\AppData\Local\Temp\f1c4541f5263d00f53859a05cb9abf83c012567eaa9c14ade29757832d4dd633N.exe
"C:\Users\Admin\AppData\Local\Temp\f1c4541f5263d00f53859a05cb9abf83c012567eaa9c14ade29757832d4dd633N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-oGc85aMKFDMbrRnT.exe

Filesize
83KB

MD5
59fc277886516cfd11b2c0fdc8336f20

SHA1
83a621d33b0fed2d0c503cacdbac4e416c794fc0

SHA256
330b302d1fd2f2ac926e79cb176d5f080f0059b27de20f1c34e2f897107ad090

SHA512
1502a2cf70b795c45e3492a520a2467c37e9f746c33777324363d6cf605ad2cc91b67be5dc89e8a8b08ed9262e28b2f1de4ff7fe851d6ca355e3db51aa810c97

Download Submit
memory/2328-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2328-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2328-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2328-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2328-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download