0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4

General

Target

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
Size

112KB
MD5

7623aee5db5091f7be1128afd257e749
SHA1

3c62076897cac52c4d3a5ed5c8df02e0a3ac34e1
SHA256

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4
SHA512

bcd9a83285523f65c200b9f0e39f8341afca7c4c3bd528ccc948d8b2a0789e4c384eb60c003b45d295bbd45b4733edadd5096e3478b5462345e9fa8b627401ce

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\protocol	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2416-133-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/2416-137-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/2416-138-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/2416-139-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/2416-140-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

description	pid	process	target process
PID 636 set thread context of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3096 2416 WerFault.exe 0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

pid	pid_target	process	target process
3096	2416	WerFault.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

pid	process
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
2416	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

pid process

2416 0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

description	pid	process	target process
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
PID 636 wrote to memory of 2416	636	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe	0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe

C:\Users\Admin\AppData\Local\Temp\0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
"C:\Users\Admin\AppData\Local\Temp\0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Local\Temp\0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe
"C:\Users\Admin\AppData\Local\Temp\0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4.exe"
2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 352
3⤵
- Program crash
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2416 -ip 2416
1⤵
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-130-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/636-135-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/636-136-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2416-132-0x0000000000000000-mapping.dmp

Download
memory/2416-133-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2416-137-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2416-138-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2416-139-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2416-140-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads