f04afa122d919fe049eb055ab6d29f8a414b4041440af660895916b7e32f20a0

Analysis

max time kernel
141s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_f201c60260bf5daf402404b095776202.exe
Size

83KB
MD5

f201c60260bf5daf402404b095776202
SHA1

1e2acb174ffb0e946e3d0cedd0a9735c12e4c7a3
SHA256

563c59f9649a67801b142a45bd90c9b13ce0bcacfed8be8cf5c9bf0f6121348d
SHA512

ed6de65b7a49bbf0fbb02079a6f909169d7f4cb7d834246f8285852037e9ef494ad4caaca6de1b05bec218d24709bb1b6772183a53628b15475142da31cc9e64
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+iKO:LJ0TAz6Mte4A+aaZx8EnCGVuiP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral29/memory/2940-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral29/memory/2940-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral29/memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral29/memory/2940-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral29/files/0x0005000000004ed7-12.dat	upx
behavioral29/memory/2940-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral29/memory/2940-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral29/memory/2940-29-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virussign.com_f201c60260bf5daf402404b095776202.exe

C:\Users\Admin\AppData\Local\Temp\virussign.com_f201c60260bf5daf402404b095776202.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_f201c60260bf5daf402404b095776202.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-dgcsuGtc8QelejCc.exe

Filesize
83KB

MD5
343e47aed3daddd2c09eb8c9d2f71bed

SHA1
b032e254cec3a904363ecebc738cae661dd06aa0

SHA256
50c6bfccb3ac63a21b84e7adecd25379e900c3b02da12a5b134b6b9c169eb4b8

SHA512
f4f163cb7e4c2447d1af9addc64dc16c82dc2e319bc34854c8a88c41ee77b248613cc383385d49b71e44034fdd31814a10851bf6284a51379a6d285cb6876cc7

Download Submit
memory/2940-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2940-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download