0e8fe646dfc58cda3a87d1d236a72708b268878ecf78d7dc77443c6814d66145

General

Target

notepad.exe
Size

2.8MB
MD5

36ea032886448b2a1e55a93594c1eba3
SHA1

9a9c0c66a5a7bbedaf75e3a09670f0307674419b
SHA256

0e8fe646dfc58cda3a87d1d236a72708b268878ecf78d7dc77443c6814d66145
SHA512

7e7e4592dd2fdf1b89dee548688932b2fc1fdc11f26ad67bb66b716b2511d9c81b36a9965c51f149702ec49f9e5035dfcf664a802d410f96994607387df416db

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3512-118-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral2/memory/3512-120-0x0000000000400000-0x0000000000A16000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url	wscript.exe

Suspicious use of SetThreadContext 17 IoCs

Processes:

notepad.exenotepad.exe

description	pid	process	target process
PID 64 set thread context of 3556	64	notepad.exe	notepad.exe
PID 3556 set thread context of 3512	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 3548	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 3924	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 4044	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 200	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 2480	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 1460	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 1008	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 2976	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 3176	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 3716	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 3952	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 1608	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 2600	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 2172	3556	notepad.exe	notepad.exe
PID 3556 set thread context of 1164	3556	notepad.exe	notepad.exe

Program crash 16 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1332	3512	WerFault.exe	notepad.exe
508	3548	WerFault.exe	notepad.exe
2068	3924	WerFault.exe	notepad.exe
1472	4044	WerFault.exe	notepad.exe
2636	200	WerFault.exe	notepad.exe
1236	2480	WerFault.exe	notepad.exe
1268	1460	WerFault.exe	notepad.exe
492	1008	WerFault.exe	notepad.exe
2296	2976	WerFault.exe	notepad.exe
2252	3176	WerFault.exe	notepad.exe
4072	3716	WerFault.exe	notepad.exe
3948	3952	WerFault.exe	notepad.exe
692	1608	WerFault.exe	notepad.exe
2560	2600	WerFault.exe	notepad.exe
1492	2172	WerFault.exe	notepad.exe
648	1164	WerFault.exe	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

notepad.exe

pid	process
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe
3556	notepad.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

notepad.exe

description	pid	process
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe
Token: SeDebugPrivilege	3556	notepad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

notepad.exe

pid process

64 notepad.exe

pid	process
64	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

notepad.exenotepad.execmd.exe

description	pid	process	target process
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 64 wrote to memory of 3556	64	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3512	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3548	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 3924	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2384	3556	notepad.exe	cmd.exe
PID 3556 wrote to memory of 2384	3556	notepad.exe	cmd.exe
PID 3556 wrote to memory of 2384	3556	notepad.exe	cmd.exe
PID 2384 wrote to memory of 2664	2384	cmd.exe	wscript.exe
PID 2384 wrote to memory of 2664	2384	cmd.exe	wscript.exe
PID 2384 wrote to memory of 2664	2384	cmd.exe	wscript.exe
PID 3556 wrote to memory of 2384	3556	notepad.exe	cmd.exe
PID 3556 wrote to memory of 2384	3556	notepad.exe	cmd.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 4044	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 200	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2480	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2480	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2480	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2480	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2480	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2480	3556	notepad.exe	notepad.exe
PID 3556 wrote to memory of 2480	3556	notepad.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\notepad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64

C:\Users\Admin\AppData\Local\Temp\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\notepad.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:3512

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3512 -s 180
4⤵
- Program crash
PID:1332

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:3548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3548 -s 192
4⤵
- Program crash
PID:508

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:3924

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3924 -s 192
4⤵
- Program crash
PID:2068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\wscript.exe
WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"
4⤵
- Drops startup file
PID:2664

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:4044

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4044 -s 180
4⤵
- Program crash
PID:1472

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:200

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 200 -s 188
4⤵
- Program crash
PID:2636

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:2480

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2480 -s 180
4⤵
- Program crash
PID:1236

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:1460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1460 -s 180
4⤵
- Program crash
PID:1268

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:1008

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1008 -s 180
4⤵
- Program crash
PID:492

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:2976

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2976 -s 108
4⤵
- Program crash
PID:2296

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:3176

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3176 -s 180
4⤵
- Program crash
PID:2252

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:3716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3716 -s 180
4⤵
- Program crash
PID:4072

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:3952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3952 -s 180
4⤵
- Program crash
PID:3948

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:1608

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1608 -s 192
4⤵
- Program crash
PID:692

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:2600

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2600 -s 196
4⤵
- Program crash
PID:2560

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:2172

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2172 -s 112
4⤵
- Program crash
PID:1492

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
PID:1164

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1164 -s 180
4⤵
- Program crash
PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\LKBNMTFJgl\r.vbs
MD5
19b2d791962e01151e4b6a40a90e8cd8

SHA1
a1ee500267dd1d457b3f840f8a00ba808bb46eb3

SHA256
67824e30ec5d2b61ffb266e8a37e9b929e82d507d09d21961b8293c99816c664

SHA512
4d39fd8f11e86490041190f1419273c702ccd85dcc603e5d7acc9d55cc60031ef1f7cc901a2c09b46d6bdc560a4c81d464c8495e7f9e8707ec7cd999f49c49fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url
MD5
e03e6937ba1878ace3d849b233adecfe

SHA1
affbb4f8b53af6cf35660b775a0a8f70fb95f8b5

SHA256
9846a8975f8e2dbc96cd18d5015c03b4d8226fddf69bcb99a0610c855b0a9e6d

SHA512
99ea03b8635d89409c6e65dc1dd1e995eac8c02e373f3b01faa7d715f347722075cc0d5d629914399505a2ca8ffb80bfa8cafa9d99a2e702d1fcd94fb0baeca9

Download Submit
memory/200-146-0x0000000000A14AA0-mapping.dmp

Download
memory/1008-161-0x0000000000A14AA0-mapping.dmp

Download
memory/1164-200-0x0000000000A14AA0-mapping.dmp

Download
memory/1460-156-0x0000000000A14AA0-mapping.dmp

Download
memory/1608-186-0x0000000000A14AA0-mapping.dmp

Download
memory/2172-196-0x0000000000A14AA0-mapping.dmp

Download
memory/2384-137-0x0000000003A40000-0x0000000003C14000-memory.dmp

Filesize
1.8MB

Download
memory/2384-134-0x0000000000000000-mapping.dmp

Download
memory/2480-151-0x0000000000A14AA0-mapping.dmp

Download
memory/2600-191-0x0000000000A14AA0-mapping.dmp

Download
memory/2664-135-0x0000000000000000-mapping.dmp

Download
memory/2976-166-0x0000000000A14AA0-mapping.dmp

Download
memory/3176-171-0x0000000000A14AA0-mapping.dmp

Download
memory/3512-121-0x0000000000A14AA0-mapping.dmp

Download
memory/3512-120-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3512-118-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3548-126-0x0000000000A14AA0-mapping.dmp

Download
memory/3556-116-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/3556-119-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/3556-117-0x0000000000404470-mapping.dmp

Download
memory/3716-176-0x0000000000A14AA0-mapping.dmp

Download
memory/3924-131-0x0000000000A14AA0-mapping.dmp

Download
memory/3952-181-0x0000000000A14AA0-mapping.dmp

Download
memory/4044-141-0x0000000000A14AA0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads