f285822ef8c947a87e556858a8332ed26edda052e597c67a7831753c376e01b4

General

Target

8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe
Size

515KB
MD5

c34157e025416d3ddf0a8610fa2e8b98
SHA1

03005c0c1469b7dbe9eff095bfd3ecbc3a713811
SHA256

f285822ef8c947a87e556858a8332ed26edda052e597c67a7831753c376e01b4
SHA512

16de23d61d7dad4f239980ac02aa765be38bc42647c63ede13441a73c002bd0b91a4681159cca9170f41fa003a7725926b61c09a124fec700028de7c425679cd

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/756-119-0x0000000000400000-0x00000000004F6000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3624 set thread context of 756	3624	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3624	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
756	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	756	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe
Token: SeCreatePagefilePrivilege	756	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3624	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 756	3624	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	79
PID 3624 wrote to memory of 756	3624	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	79
PID 3624 wrote to memory of 756	3624	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	79
PID 3624 wrote to memory of 756	3624	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	79
PID 756 wrote to memory of 3564	756	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	81
PID 756 wrote to memory of 3564	756	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	81
PID 756 wrote to memory of 3564	756	8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe	81

C:\Users\Admin\AppData\Local\Temp\8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe
"C:\Users\Admin\AppData\Local\Temp\8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\8oWCLvjJR6h_VWhYqDMu0m7doFLll8Z6eDF1PDduAbQ.bin.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0zXqiXKfY352smBk.bat" "
    3⤵
    PID:3564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-119-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/756-120-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3624-116-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/3624-117-0x00000000023D0000-0x00000000023D7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing