544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e

General

Target

544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
Size

1.5MB
MD5

0a383f6b665eb5e072773c9875d459cd
SHA1

aed86ee444beb6eddd188cc58f6e69430c1274ed
SHA256

544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e
SHA512

c93aefa7e61e379047dd967f5af0b57803b34228921037ea01893b40002ea079c7c57228b23e3770ff4c8d5c0ec175f58bd037a9f4fef8415a60308176437a9f

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1076-34-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1076-39-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1076-40-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

Processes:

544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe

description	pid	process	target process
PID 1088 set thread context of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 set thread context of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exesvchost.exe544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe

pid	process
1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
744	svchost.exe
1076	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe

description	pid	process	target process
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 744	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	svchost.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
PID 1088 wrote to memory of 1076	1088	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe	544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe

C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
"C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:744

C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
"C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-31-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/744-33-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/744-35-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/744-32-0x000000000040B000-mapping.dmp

Download
memory/1076-40-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1076-39-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1076-37-0x00000000004085D0-mapping.dmp

Download
memory/1076-34-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1088-22-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-27-0x0000000000668000-0x0000000000669000-memory.dmp

Filesize
4KB

Download
memory/1088-12-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-13-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-16-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-17-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-18-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-19-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-2-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-23-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-24-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-25-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-26-0x0000000000668000-0x0000000000669000-memory.dmp

Filesize
4KB

Download
memory/1088-11-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-28-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-29-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-30-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-10-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-9-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-8-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-7-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-6-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-5-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-4-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download
memory/1088-3-0x0000000000666000-0x0000000000667000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads