861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471

General

Target

861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
Size

1.5MB
MD5

1c72f2ac3f8aedcb677d1843030402e2
SHA1

0b4a2c3e4c919c95c2543eaad8bb8e207fede04c
SHA256

861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471
SHA512

0532968f04a30cf7e63f95d6bcbd13a8a59ea13afefd8987aba2811f22c0995adabff33773b335933ea8064aeebdb83af4168bf6f75940d8ea1130c59a6e38f4

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1528-34-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1528-37-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1528-39-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

Processes:

861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe

description	pid	process	target process
PID 316 set thread context of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 set thread context of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe
1060	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exesvchost.exe861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe

pid	process
316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
1060	svchost.exe
1528	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe

description	pid	process	target process
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1060	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	svchost.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
PID 316 wrote to memory of 1528	316	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe	861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe

C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
"C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
"C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-22-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-9-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-4-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-2-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-6-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-7-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-8-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-23-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-10-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-11-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-12-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-13-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-16-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-24-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-18-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-19-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-5-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-3-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-17-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-25-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-26-0x00000000009E8000-0x00000000009E9000-memory.dmp

Filesize
4KB

Download
memory/316-27-0x00000000009E8000-0x00000000009E9000-memory.dmp

Filesize
4KB

Download
memory/316-28-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-29-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/316-30-0x00000000009E6000-0x00000000009E7000-memory.dmp

Filesize
4KB

Download
memory/1060-31-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1060-32-0x000000000040B000-mapping.dmp

Download
memory/1060-33-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1060-36-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-34-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1528-35-0x00000000004085D0-mapping.dmp

Download
memory/1528-37-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1528-39-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads