bd16cb7e846f7fd0db0791c3cda55ddf1647433ee301f936c3426a7cb5e32c53

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd16cb7e846f7fd0db0791c3cda55ddf1647433ee301f936c3426a7cb5e32c53.exe
Size

83KB
MD5

2b374b901fbdc1965e6063c35cd2e99f
SHA1

60cb33a3861ce067d574ae890d57ac697ce6fd2a
SHA256

bd16cb7e846f7fd0db0791c3cda55ddf1647433ee301f936c3426a7cb5e32c53
SHA512

becbfaf5ba47e88be81a53124502339552a0c8a5774c35b8ffff48fbf44b70cfcf5dd93934f6d0be379660f423d1cc78a3ee11b7dd2330d400abad2a4e55a87a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+iKO:LJ0TAz6Mte4A+aaZx8EnCGVuiv

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1756-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1756-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1756-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-11.dat	upx
behavioral1/memory/1756-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1756-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd16cb7e846f7fd0db0791c3cda55ddf1647433ee301f936c3426a7cb5e32c53.exe

C:\Users\Admin\AppData\Local\Temp\bd16cb7e846f7fd0db0791c3cda55ddf1647433ee301f936c3426a7cb5e32c53.exe
"C:\Users\Admin\AppData\Local\Temp\bd16cb7e846f7fd0db0791c3cda55ddf1647433ee301f936c3426a7cb5e32c53.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-ATsv1aldo3U9Uf1A.exe

Filesize
83KB

MD5
3c3a3bf8314f7999c853ad783a141fdb

SHA1
62e307dac9fef87869a819e65f68c70bb1805465

SHA256
a6482b819c8c5c72908271407da77b86b60379a0dd1074a95597fc1a5afa5322

SHA512
b0bdbded719b52cdcded6f9f4dff5125d35f198d88200f39d5af6a1b34f09d19adc032601a6c19fa353208db360c640d51fe1a51c5f3a2c1e1317e3565208e23

Download Submit
memory/1756-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1756-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1756-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1756-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1756-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download