1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c

General

Target
1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
Size 234KB
Sample200624-mtr2dbrnbe
SHA256 1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c
MD5 79c8f50c8f8b81fa783825f15c1406e5
SHA1 789cb9f8527267e2fc5d8d43b703d983e377cd9a
SHA512 1d44b5ad260fb0f84cc0a1a238c9dd1e98bad7c30d78827dd214a6f720eb5b55ecc2c6ad821e6c06467ac37290925429c624cb43971ce0694e85726afccbbd41
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 3024 wrote to memory of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67
PID 2412 wrote to memory of 3800	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	68
PID 2412 wrote to memory of 3800	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	68
PID 2412 wrote to memory of 3800	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	68
PID 2412 wrote to memory of 3836	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	69
PID 2412 wrote to memory of 3836	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	69
PID 2412 wrote to memory of 3836	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	69
PID 2412 wrote to memory of 3848	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	70
PID 2412 wrote to memory of 3848	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	70
PID 2412 wrote to memory of 3848	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	70
PID 2412 wrote to memory of 3896	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	71
PID 2412 wrote to memory of 3896	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	71
PID 2412 wrote to memory of 3896	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	71
PID 2412 wrote to memory of 3920	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	72
PID 2412 wrote to memory of 3920	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	72
PID 2412 wrote to memory of 3920	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	72
PID 2412 wrote to memory of 3920	2412	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	72

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 2412	3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe	67

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2412-1-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2412-3-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2412-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
3920	fixmapi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
3024	1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe

C:\Users\Admin\AppData\Local\Temp\1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
"C:\Users\Admin\AppData\Local\Temp\1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:3024
- C:\Users\Admin\AppData\Local\Temp\1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
  C:\Users\Admin\AppData\Local\Temp\1b81bb8eba4f537a34f2ca2ab55b98b28eda558e2ef11a3fcf2f167f4ef6b66c.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\fixmapi.exe
    fixmapi.exe
    3⤵
    PID:3800
- - C:\Windows\SysWOW64\fixmapi.exe
    fixmapi.exe
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\fixmapi.exe
    fixmapi.exe
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\fixmapi.exe
    fixmapi.exe
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\fixmapi.exe
    fixmapi.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-1-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2412-3-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2412-4-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/3024-0-0x00000000047D0000-0x00000000047D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads