328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725

Analysis

max time kernel
19s
max time network
141s
platform
windows7_x64
resource
win7v20201028
submitted
24-11-2020 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
Size

7.2MB
MD5

737f4d07b9bb5435fd670f956030d01f
SHA1

f608b036034549486d563a59265c1c3bb9466fe0
SHA256

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1
SHA512

7c2f3a30bbd1f26a555d7ada2ea4e45a8461ea11ac4ec7552fbd85f545afae16cecac21319f9a6df770cdca8f2785162a03bc8cec5fcf0da3e69a540e0900427

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Upgrader4.exee247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

pid process

596 Upgrader4.exe
1012 e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

pid	process
596	Upgrader4.exe
1012	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Upgrader4.exe	upx
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe	upx
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe	upx

Deletes itself 1 IoCs

Processes:

Upgrader4.exe

pid process

596 Upgrader4.exe
Loads dropped DLL 2 IoCs

Processes:

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exeUpgrader4.exe

pid process

1640 e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
596 Upgrader4.exe

pid	process
596	Upgrader4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exee247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

pid	process
1640	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
1012	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exeUpgrader4.exe

description	pid	process	target process
PID 1640 wrote to memory of 596	1640	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe	Upgrader4.exe
PID 1640 wrote to memory of 596	1640	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe	Upgrader4.exe
PID 1640 wrote to memory of 596	1640	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe	Upgrader4.exe
PID 1640 wrote to memory of 596	1640	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe	Upgrader4.exe
PID 596 wrote to memory of 1012	596	Upgrader4.exe	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
PID 596 wrote to memory of 1012	596	Upgrader4.exe	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
PID 596 wrote to memory of 1012	596	Upgrader4.exe	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
PID 596 wrote to memory of 1012	596	Upgrader4.exe	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
"C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe
  C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe +/afterupgrade0
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
    C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe /afterupgrade
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D73194RS\update[1].inf

MD5
578c274b4f50f686d58c082199955bc9

SHA1
a8a85dcb02b70640699d141071ea7b190371bd53

SHA256
a2da6691b1bdc2b72ade8ca646d5a342fb5d607c205218ea21a3fe3cfd82e92e

SHA512
1388c1f3a7234ab9bd94cb872eef81a5b9861fb42d679295e527d0efae6c3799b2364de27e3096dda96572c827748ed791f05babbfefbf766ea0085e40fac855

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe

MD5
486f9957b55a6756adb71115e9dec850

SHA1
da03821bacebe84f3c8e74999446557f203edd02

SHA256
4de7e69425542f5ccb5df205a278e247ec95ab4e0851a9632a50890e8ef5161d

SHA512
85c11f78037393d712a892ffba10b568640df17e08af3b23f12911f6e76aa265bf0a2dabab86d4c4e934695f3d8c4352cb536398aa6b9caed277206e76962211

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe

MD5
486f9957b55a6756adb71115e9dec850

SHA1
da03821bacebe84f3c8e74999446557f203edd02

SHA256
4de7e69425542f5ccb5df205a278e247ec95ab4e0851a9632a50890e8ef5161d

SHA512
85c11f78037393d712a892ffba10b568640df17e08af3b23f12911f6e76aa265bf0a2dabab86d4c4e934695f3d8c4352cb536398aa6b9caed277206e76962211

Download Submit
C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

MD5
cb0a34d7fe24860ea7cb543cb5379d36

SHA1
871938e166d80a8adc43cd3bb1980e5369f8bf2f

SHA256
179640244994999c32025bef752f9431ee9f0af4dc20a3ab7dd8ba99dfe95b40

SHA512
a0f9cca5e43d47aeb800fda54b03fbb0342150767b1f2d22fdbff761a7abe30c8389a1dec9d5ad3d587146bbbc5392949973673dfd49686bb919da5ed45dc57f

Download Submit
C:\Users\Admin\AppData\Local\Temp\win10update_v3.5.42.208.exe.uTMP

MD5
cb0a34d7fe24860ea7cb543cb5379d36

SHA1
871938e166d80a8adc43cd3bb1980e5369f8bf2f

SHA256
179640244994999c32025bef752f9431ee9f0af4dc20a3ab7dd8ba99dfe95b40

SHA512
a0f9cca5e43d47aeb800fda54b03fbb0342150767b1f2d22fdbff761a7abe30c8389a1dec9d5ad3d587146bbbc5392949973673dfd49686bb919da5ed45dc57f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WKLFEDGT.txt

MD5
2f538eb35bfdae28e3dedab1889df71b

SHA1
9fc16be8878d72b9f25ae163c0416f41b88e1422

SHA256
a2ee8ee3cf90fc225b8cd86236b89a9789ea12581e01ca0fc94fd323ed52246c

SHA512
c21f0604e96c2e35ff67de34170dee9499f9d49d47d5e306ce8c7c8f3c496bf6ebf34350bcd9527d988ce568bf32f4f88ec29c1b7737311296253c357c04a723

Download Submit
\Users\Admin\AppData\Local\Temp\Upgrader4.exe

MD5
486f9957b55a6756adb71115e9dec850

SHA1
da03821bacebe84f3c8e74999446557f203edd02

SHA256
4de7e69425542f5ccb5df205a278e247ec95ab4e0851a9632a50890e8ef5161d

SHA512
85c11f78037393d712a892ffba10b568640df17e08af3b23f12911f6e76aa265bf0a2dabab86d4c4e934695f3d8c4352cb536398aa6b9caed277206e76962211

Download Submit
\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

MD5
cb0a34d7fe24860ea7cb543cb5379d36

SHA1
871938e166d80a8adc43cd3bb1980e5369f8bf2f

SHA256
179640244994999c32025bef752f9431ee9f0af4dc20a3ab7dd8ba99dfe95b40

SHA512
a0f9cca5e43d47aeb800fda54b03fbb0342150767b1f2d22fdbff761a7abe30c8389a1dec9d5ad3d587146bbbc5392949973673dfd49686bb919da5ed45dc57f

Download Submit
memory/596-2-0x0000000000000000-mapping.dmp

Download
memory/880-0-0x000007FEF7B10000-0x000007FEF7D8A000-memory.dmp

Filesize
2.5MB

Download
memory/1012-7-0x0000000000000000-mapping.dmp

Download