c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9

Analysis

max time kernel
149s
max time network
142s
platform
windows10_x64
resource
win10v200722
submitted
04/08/2020, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OC_Y590382614.exe
Size 1.2MB
Sample200804-gmvnet5v1e
SHA256 c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
MD5 702a370d537ad9909efe4645ff854a3e
SHA1 cd7dc538b01dea63f5c619ebe4de89ba75b3a245
SHA512 b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d
MD5 SHA1 SHA512

Score

9^/10

upx

Malware Config

Signatures

Executes dropped EXE 19 IoCs

pid	Process
3920	app.exe
3076	app.exe
500	app.exe
1416	app.exe
2392	app.exe
2624	app.exe
4024	app.exe
4064	app.exe
516	app.exe
2740	app.exe
3816	app.exe
3988	app.exe
2112	app.exe
1360	app.exe
3068	app.exe
3688	app.exe
3388	app.exe
788	app.exe
2628	app.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	app.exe
Token: SeRestorePrivilege	1288	WerFault.exe
Token: SeBackupPrivilege	1288	WerFault.exe
Token: SeDebugPrivilege	1288	WerFault.exe
Token: SeDebugPrivilege	2392	app.exe
Token: SeDebugPrivilege	2540	WerFault.exe
Token: SeDebugPrivilege	4064	app.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	3816	app.exe
Token: SeDebugPrivilege	2228	WerFault.exe
Token: SeDebugPrivilege	1360	app.exe
Token: SeDebugPrivilege	3696	WerFault.exe
Token: SeDebugPrivilege	3388	app.exe
Token: SeDebugPrivilege	2108	powershell.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1288	1520	WerFault.exe	74
2540	2696	WerFault.exe	85
2228	420	WerFault.exe	100
3696	3276	WerFault.exe	107

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\appdata\app.exe:ZoneIdentifier	notepad.exe

ServiceHost packer 20 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/1520-19-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1520-20-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1520-21-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1520-22-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1520-23-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2696-49-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2696-50-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2696-51-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2696-52-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2696-53-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/420-91-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/420-90-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/420-93-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/420-92-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/420-94-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3276-114-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3276-113-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3276-115-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3276-116-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3276-117-0x0000000000000000-mapping.dmp	servicehost

Suspicious behavior: EnumeratesProcesses 763 IoCs

pid	Process
3924	OC_Y590382614.exe
3924	OC_Y590382614.exe
3920	app.exe
3920	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
3076	app.exe
3076	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
500	app.exe
1416	app.exe
1416	app.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2392	app.exe
2392	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
2624	app.exe
4024	app.exe
4024	app.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
4064	app.exe
4064	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
516	app.exe
2740	app.exe
2740	app.exe
3092	powershell.exe
3092	powershell.exe
3092	powershell.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3816	app.exe
3816	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
3988	app.exe
2112	app.exe
2112	app.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
1360	app.exe
1360	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3068	app.exe
3688	app.exe
3688	app.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
3388	app.exe
3388	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
788	app.exe
2108	powershell.exe
2628	app.exe
2628	app.exe
2108	powershell.exe
2108	powershell.exe

Suspicious use of WriteProcessMemory 98 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2716	3924	OC_Y590382614.exe	66
PID 3924 wrote to memory of 2716	3924	OC_Y590382614.exe	66
PID 3924 wrote to memory of 2716	3924	OC_Y590382614.exe	66
PID 3924 wrote to memory of 2716	3924	OC_Y590382614.exe	66
PID 3924 wrote to memory of 2716	3924	OC_Y590382614.exe	66
PID 2716 wrote to memory of 3920	2716	notepad.exe	67
PID 2716 wrote to memory of 3920	2716	notepad.exe	67
PID 2716 wrote to memory of 3920	2716	notepad.exe	67
PID 3920 wrote to memory of 3076	3920	app.exe	68
PID 3920 wrote to memory of 3076	3920	app.exe	68
PID 3920 wrote to memory of 3076	3920	app.exe	68
PID 3920 wrote to memory of 500	3920	app.exe	69
PID 3920 wrote to memory of 500	3920	app.exe	69
PID 3920 wrote to memory of 500	3920	app.exe	69
PID 3076 wrote to memory of 1240	3076	app.exe	71
PID 3076 wrote to memory of 1240	3076	app.exe	71
PID 3076 wrote to memory of 1240	3076	app.exe	71
PID 500 wrote to memory of 1416	500	app.exe	73
PID 500 wrote to memory of 1416	500	app.exe	73
PID 500 wrote to memory of 1416	500	app.exe	73
PID 1240 wrote to memory of 1520	1240	cmd.exe	74
PID 1240 wrote to memory of 1520	1240	cmd.exe	74
PID 1240 wrote to memory of 1520	1240	cmd.exe	74
PID 1416 wrote to memory of 2392	1416	app.exe	77
PID 1416 wrote to memory of 2392	1416	app.exe	77
PID 1416 wrote to memory of 2392	1416	app.exe	77
PID 1416 wrote to memory of 2624	1416	app.exe	78
PID 1416 wrote to memory of 2624	1416	app.exe	78
PID 1416 wrote to memory of 2624	1416	app.exe	78
PID 2392 wrote to memory of 3728	2392	app.exe	81
PID 2392 wrote to memory of 3728	2392	app.exe	81
PID 2392 wrote to memory of 3728	2392	app.exe	81
PID 2624 wrote to memory of 4024	2624	app.exe	84
PID 2624 wrote to memory of 4024	2624	app.exe	84
PID 2624 wrote to memory of 4024	2624	app.exe	84
PID 3728 wrote to memory of 2696	3728	cmd.exe	85
PID 3728 wrote to memory of 2696	3728	cmd.exe	85
PID 3728 wrote to memory of 2696	3728	cmd.exe	85
PID 4024 wrote to memory of 4064	4024	app.exe	87
PID 4024 wrote to memory of 4064	4024	app.exe	87
PID 4024 wrote to memory of 4064	4024	app.exe	87
PID 4024 wrote to memory of 516	4024	app.exe	88
PID 4024 wrote to memory of 516	4024	app.exe	88
PID 4024 wrote to memory of 516	4024	app.exe	88
PID 4064 wrote to memory of 3176	4064	app.exe	91
PID 4064 wrote to memory of 3176	4064	app.exe	91
PID 4064 wrote to memory of 3176	4064	app.exe	91
PID 3176 wrote to memory of 3092	3176	cmd.exe	93
PID 3176 wrote to memory of 3092	3176	cmd.exe	93
PID 3176 wrote to memory of 3092	3176	cmd.exe	93
PID 516 wrote to memory of 2740	516	app.exe	94
PID 516 wrote to memory of 2740	516	app.exe	94
PID 516 wrote to memory of 2740	516	app.exe	94
PID 2740 wrote to memory of 3816	2740	app.exe	96
PID 2740 wrote to memory of 3816	2740	app.exe	96
PID 2740 wrote to memory of 3816	2740	app.exe	96
PID 2740 wrote to memory of 3988	2740	app.exe	97
PID 2740 wrote to memory of 3988	2740	app.exe	97
PID 2740 wrote to memory of 3988	2740	app.exe	97
PID 3816 wrote to memory of 640	3816	app.exe	98
PID 3816 wrote to memory of 640	3816	app.exe	98
PID 3816 wrote to memory of 640	3816	app.exe	98
PID 640 wrote to memory of 420	640	cmd.exe	100
PID 640 wrote to memory of 420	640	cmd.exe	100
PID 640 wrote to memory of 420	640	cmd.exe	100
PID 3988 wrote to memory of 2112	3988	app.exe	101
PID 3988 wrote to memory of 2112	3988	app.exe	101
PID 3988 wrote to memory of 2112	3988	app.exe	101
PID 2112 wrote to memory of 1360	2112	app.exe	103
PID 2112 wrote to memory of 1360	2112	app.exe	103
PID 2112 wrote to memory of 1360	2112	app.exe	103
PID 2112 wrote to memory of 3068	2112	app.exe	104
PID 2112 wrote to memory of 3068	2112	app.exe	104
PID 2112 wrote to memory of 3068	2112	app.exe	104
PID 1360 wrote to memory of 3840	1360	app.exe	105
PID 1360 wrote to memory of 3840	1360	app.exe	105
PID 1360 wrote to memory of 3840	1360	app.exe	105
PID 3840 wrote to memory of 3276	3840	cmd.exe	107
PID 3840 wrote to memory of 3276	3840	cmd.exe	107
PID 3840 wrote to memory of 3276	3840	cmd.exe	107
PID 3068 wrote to memory of 3688	3068	app.exe	108
PID 3068 wrote to memory of 3688	3068	app.exe	108
PID 3068 wrote to memory of 3688	3068	app.exe	108
PID 3688 wrote to memory of 3388	3688	app.exe	110
PID 3688 wrote to memory of 3388	3688	app.exe	110
PID 3688 wrote to memory of 3388	3688	app.exe	110
PID 3688 wrote to memory of 788	3688	app.exe	111
PID 3688 wrote to memory of 788	3688	app.exe	111
PID 3688 wrote to memory of 788	3688	app.exe	111
PID 3388 wrote to memory of 3796	3388	app.exe	112
PID 3388 wrote to memory of 3796	3388	app.exe	112
PID 3388 wrote to memory of 3796	3388	app.exe	112
PID 3796 wrote to memory of 2108	3796	cmd.exe	114
PID 3796 wrote to memory of 2108	3796	cmd.exe	114
PID 3796 wrote to memory of 2108	3796	cmd.exe	114
PID 788 wrote to memory of 2628	788	app.exe	115
PID 788 wrote to memory of 2628	788	app.exe	115
PID 788 wrote to memory of 2628	788	app.exe	115

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3920	app.exe
1416	app.exe
4024	app.exe
2740	app.exe
2112	app.exe
3688	app.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 3076	3920	app.exe	68
PID 1416 set thread context of 2392	1416	app.exe	77
PID 4024 set thread context of 4064	4024	app.exe	87
PID 2740 set thread context of 3816	2740	app.exe	96
PID 2112 set thread context of 1360	2112	app.exe	103
PID 3688 set thread context of 3388	3688	app.exe	110

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3076-4-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3076-4-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3076-8-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3076-8-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3076-9-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3076-9-0x0000000000400000-0x0000000000582000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\OC_Y590382614.exe
"C:\Users\Admin\AppData\Local\Temp\OC_Y590382614.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Roaming\appdata\app.exe
    "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetThreadContext
    PID:3920
  - - C:\Users\Admin\AppData\Roaming\appdata\app.exe
      "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1240
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe'
        6⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 704
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Program crash
        
        PID:1288
  - - C:\Users\Admin\AppData\Roaming\appdata\app.exe
      "C:\Users\Admin\AppData\Roaming\appdata\app.exe" 2 3076 94921
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:500
    - - C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetThreadContext
        
        PID:1416
      - C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe' & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe'
        8⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 680
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Program crash
        
        PID:2540
      - C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe" 2 2392 112546
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetThreadContext
        
        PID:4024
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe' & exit
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe'
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe" 2 4064 137734
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetThreadContext
        
        PID:2740
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe' & exit
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe'
        12⤵
        
        PID:420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 680
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Program crash
        
        PID:2228
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe" 2 3816 167531
        10⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetThreadContext
        
        PID:2112
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe' & exit
        13⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe'
        14⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 704
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Program crash
        
        PID:3696
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe" 2 1360 179468
        12⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetThreadContext
        
        PID:3688
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe' & exit
        15⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Roaming\appdata\app.exe'
        16⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe" 2 3388 219296
        14⤵
        Executes dropped EXE
        
        PID:788
        
        C:\Users\Admin\AppData\Roaming\appdata\app.exe
        
        "C:\Users\Admin\AppData\Roaming\appdata\app.exe"
        15⤵
        Executes dropped EXE
        
        PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-24-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/1288-18-0x00000000047E0000-0x00000000047E1000-memory.dmp

Download

memory/1360-106-0x0000000000BF2000-0x0000000000BF3000-memory.dmp

Download

memory/1360-105-0x00000000023D0000-0x0000000002488000-memory.dmp

Download

memory/2228-95-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/2228-89-0x0000000004340000-0x0000000004341000-memory.dmp

Download

memory/2392-33-0x00000000022B2000-0x00000000022B3000-memory.dmp

Download

memory/2392-32-0x0000000002440000-0x00000000024F8000-memory.dmp

Download

memory/2540-54-0x0000000005340000-0x0000000005341000-memory.dmp

Download

memory/2540-48-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/3076-8-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3076-4-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3076-11-0x0000000002460000-0x0000000002518000-memory.dmp

Download

memory/3076-9-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3076-12-0x0000000002452000-0x0000000002453000-memory.dmp

Download

memory/3388-127-0x00000000023C2000-0x00000000023C3000-memory.dmp

Download

memory/3696-112-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Download

memory/3696-119-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/3816-81-0x00000000023F0000-0x00000000024A8000-memory.dmp

Download

memory/3816-82-0x0000000002512000-0x0000000002513000-memory.dmp

Download

memory/4064-68-0x00000000024E2000-0x00000000024E3000-memory.dmp

Download

memory/4064-67-0x00000000024F0000-0x00000000025A8000-memory.dmp

Download