a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6

General

Target

a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
Size

1.5MB
MD5

024031a11521b17f29263c4da1e3b575
SHA1

5889feced3e587271f4943ac487067734c9c8d93
SHA256

a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6
SHA512

04edd2e7e3565d1f8dbe9394bf7f4cb5010a1e9845a5068addb62dfce9b07d65f4e5f45361c4d88172067eb48871501d6881688c13148581474f7a185a80d3b6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1080-35-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1080-39-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1080-40-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

Processes:

a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe

description	pid	process	target process
PID 1324 set thread context of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 set thread context of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exesvchost.exea19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe

pid	process
1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
1084	svchost.exe
1080	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe

description	pid	process	target process
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1084	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	svchost.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
PID 1324 wrote to memory of 1080	1324	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe	a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe

C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
"C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1084

C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
"C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-40-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1080-39-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1080-37-0x00000000004085D0-mapping.dmp

Download
memory/1080-35-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1084-31-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1084-33-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1084-34-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1084-32-0x000000000040B000-mapping.dmp

Download
memory/1324-22-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-27-0x0000000000738000-0x0000000000739000-memory.dmp

Filesize
4KB

Download
memory/1324-12-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-13-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-16-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-17-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-18-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-19-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-2-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-23-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-24-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-25-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-26-0x0000000000738000-0x0000000000739000-memory.dmp

Filesize
4KB

Download
memory/1324-11-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-28-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-29-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-30-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-10-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-9-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-8-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-7-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-6-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-5-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-4-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download
memory/1324-3-0x0000000000736000-0x0000000000737000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads