9b582a234ab156767b12fef549c71e8a50f014d8e8a75a5b79ae8101eabdb29a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b582a234ab156767b12fef549c71e8a50f014d8e8a75a5b79ae8101eabdb29a.exe
Size 236KB
Sample250127-sdhpyavkfq
SHA256 9b582a234ab156767b12fef549c71e8a50f014d8e8a75a5b79ae8101eabdb29a
MD5 0d2bcc1940b551ffc47d96a38225d4e8
SHA1 b05cb9b50fc8586e6206de0e83643face48bb432
SHA512 0d6dd8ccca418b28f9218429b2b8cebb946ae63c8bc78c387ff332398602b703324be1f660f9553283f41eacf07f4d925308769b733ae873ce9070ff6a910c66
SSDEEP 3072:3J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/L/FnncroP9X:ZwDeM7iNEkgiOb31k1ECLJ/FX
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4612-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4612-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0009000000023c50-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b582a234ab156767b12fef549c71e8a50f014d8e8a75a5b79ae8101eabdb29a.exe

C:\Users\Admin\AppData\Local\Temp\9b582a234ab156767b12fef549c71e8a50f014d8e8a75a5b79ae8101eabdb29a.exe
"C:\Users\Admin\AppData\Local\Temp\9b582a234ab156767b12fef549c71e8a50f014d8e8a75a5b79ae8101eabdb29a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-5ETTUH8pucdNrS9G.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-5ETTUH8pucdNrS9G.exe
Size 236KB
SHA256 3e47d82c83bd1cdae8c7fb70a81fbff968046177bd907b8cb52dfe463b5f66da
MD5 bea05fa8316f03358ea7719309220988
SHA1 ae83cd8119fb46b2994438b2b3379714c82695dd
SHA512 73c2ea4bbc1bbeeb68bd1bd4c4248a17a79d569c5524e4e4cc2976bd88a5ea3954d986a86273f5b37b534df0787e24abe905896b8c705ffc48028b1f9f423833
SSDEEP 3072:3J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/h/FnncroP9X:ZwDeM7iNEkgiOb31k1ECtJ/FX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4612-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4612-1-0x0000000000400000-0x000000000043B000-memory.dmp