6c2ca93949c6c8463079056deb121abcaea9934dcd860024624a4b0d53093204

General

Target

confirmación de solicitud de documento DOC.ex.exe
Size

628KB
MD5

f92cfccc787573ad96e73fe5df999ebc
SHA1

8213016a7c85c3ca70f30b9afdc60d3d6e4c82cc
SHA256

6c2ca93949c6c8463079056deb121abcaea9934dcd860024624a4b0d53093204
SHA512

631163c9150eb79d001859d46df7b8df184c98c2ead25332a179642a681f5bea890094d935fb4299d2691b2fc82188e180bd96a89767cf68c3dd08b95257385f

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/672-72-0x0000000010410000-0x00000000107F4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

confirmación de solicitud de documento DOC.ex.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bpwzer = "C:\\Users\\Public\\Libraries\\rezwpB.url"	confirmación de solicitud de documento DOC.ex.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

dialer.exe

pid process

672 dialer.exe
672 dialer.exe
672 dialer.exe
672 dialer.exe
672 dialer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dialer.exe

description pid process

Token: SeDebugPrivilege 672 dialer.exe
Token: SeShutdownPrivilege 672 dialer.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dialer.exe

pid process

672 dialer.exe
672 dialer.exe

pid	process
672	dialer.exe
672	dialer.exe
672	dialer.exe
672	dialer.exe
672	dialer.exe

description	pid	process
Token: SeDebugPrivilege	672	dialer.exe
Token: SeShutdownPrivilege	672	dialer.exe

pid	process
672	dialer.exe
672	dialer.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

confirmación de solicitud de documento DOC.ex.exe

description	pid	process	target process
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe
PID 1688 wrote to memory of 672	1688	confirmación de solicitud de documento DOC.ex.exe	dialer.exe

C:\Users\Admin\AppData\Local\Temp\confirmación de solicitud de documento DOC.ex.exe
"C:\Users\Admin\AppData\Local\Temp\confirmación de solicitud de documento DOC.ex.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\dialer.exe
C:\Windows\System32\dialer.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-65-0x0000000000000000-mapping.dmp

Download
memory/672-67-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/672-71-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/672-72-0x0000000010410000-0x00000000107F4000-memory.dmp

Filesize
3.9MB

Download
memory/672-73-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1688-59-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1688-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1688-62-0x00000000003D0000-0x00000000003EA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads