328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725

Analysis

max time kernel
21s
max time network
129s
platform
windows10_x64
resource
win10v20201028
submitted
24-11-2020 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
Size

7.2MB
MD5

737f4d07b9bb5435fd670f956030d01f
SHA1

f608b036034549486d563a59265c1c3bb9466fe0
SHA256

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1
SHA512

7c2f3a30bbd1f26a555d7ada2ea4e45a8461ea11ac4ec7552fbd85f545afae16cecac21319f9a6df770cdca8f2785162a03bc8cec5fcf0da3e69a540e0900427

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Upgrader4.exee247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

pid process

3432 Upgrader4.exe
212 e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

pid	process
3432	Upgrader4.exe
212	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe	upx
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe	upx

Deletes itself 1 IoCs

Processes:

Upgrader4.exe

pid process

3432 Upgrader4.exe

pid	process
3432	Upgrader4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exee247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

pid	process
3932	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
212	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exeUpgrader4.exe

description	pid	process	target process
PID 3932 wrote to memory of 3432	3932	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe	Upgrader4.exe
PID 3932 wrote to memory of 3432	3932	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe	Upgrader4.exe
PID 3932 wrote to memory of 3432	3932	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe	Upgrader4.exe
PID 3432 wrote to memory of 212	3432	Upgrader4.exe	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
PID 3432 wrote to memory of 212	3432	Upgrader4.exe	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
PID 3432 wrote to memory of 212	3432	Upgrader4.exe	e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
"C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe
  C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe +/afterupgrade0
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
    C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe /afterupgrade
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RW8YYLAG\update[1].inf

MD5
578c274b4f50f686d58c082199955bc9

SHA1
a8a85dcb02b70640699d141071ea7b190371bd53

SHA256
a2da6691b1bdc2b72ade8ca646d5a342fb5d607c205218ea21a3fe3cfd82e92e

SHA512
1388c1f3a7234ab9bd94cb872eef81a5b9861fb42d679295e527d0efae6c3799b2364de27e3096dda96572c827748ed791f05babbfefbf766ea0085e40fac855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\UZA2PJZJ.cookie

MD5
465b6a53f8a95ab3e1d3e17a275421e0

SHA1
3e320614eaf6048ecab5f3a0f6f104ece5402f39

SHA256
bea47e516026d9b81b29c9913c9f84aeeeb32492fb962fa5b5e3e49f38cdad49

SHA512
a607d5efbc1b857a1018adea7dcf6502509dae6f0270acac11fd48bdd2cb6df316c50ac1ebf2c2f4f9345ac61dd108a46f17abf6f6f675abbafd89bfcd8c8a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe

MD5
486f9957b55a6756adb71115e9dec850

SHA1
da03821bacebe84f3c8e74999446557f203edd02

SHA256
4de7e69425542f5ccb5df205a278e247ec95ab4e0851a9632a50890e8ef5161d

SHA512
85c11f78037393d712a892ffba10b568640df17e08af3b23f12911f6e76aa265bf0a2dabab86d4c4e934695f3d8c4352cb536398aa6b9caed277206e76962211

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exe

MD5
486f9957b55a6756adb71115e9dec850

SHA1
da03821bacebe84f3c8e74999446557f203edd02

SHA256
4de7e69425542f5ccb5df205a278e247ec95ab4e0851a9632a50890e8ef5161d

SHA512
85c11f78037393d712a892ffba10b568640df17e08af3b23f12911f6e76aa265bf0a2dabab86d4c4e934695f3d8c4352cb536398aa6b9caed277206e76962211

Download Submit
C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe

MD5
cb0a34d7fe24860ea7cb543cb5379d36

SHA1
871938e166d80a8adc43cd3bb1980e5369f8bf2f

SHA256
179640244994999c32025bef752f9431ee9f0af4dc20a3ab7dd8ba99dfe95b40

SHA512
a0f9cca5e43d47aeb800fda54b03fbb0342150767b1f2d22fdbff761a7abe30c8389a1dec9d5ad3d587146bbbc5392949973673dfd49686bb919da5ed45dc57f

Download Submit
C:\Users\Admin\AppData\Local\Temp\win10update_v3.5.42.208.exe.uTMP

MD5
cb0a34d7fe24860ea7cb543cb5379d36

SHA1
871938e166d80a8adc43cd3bb1980e5369f8bf2f

SHA256
179640244994999c32025bef752f9431ee9f0af4dc20a3ab7dd8ba99dfe95b40

SHA512
a0f9cca5e43d47aeb800fda54b03fbb0342150767b1f2d22fdbff761a7abe30c8389a1dec9d5ad3d587146bbbc5392949973673dfd49686bb919da5ed45dc57f

Download Submit
memory/212-4-0x0000000000000000-mapping.dmp

Download
memory/3432-0-0x0000000000000000-mapping.dmp

Download