56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
Size

72KB
MD5

3f7ad33f4d00b444ac42dbaa58d8c2ee
SHA1

2c1e653d7e3f026f3801bcef183981dac1db8393
SHA256

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099
SHA512

c292fc18f6be09ba3c24028a3726d99d8f57a9592a2a6d4dd80f03a18e2ae5d16da099cd88c132921cee9594371e8cf853a955566b245a7f38ff15593ab5a924

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1656-133-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1656-136-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/1656-137-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1656-138-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1656-139-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/1656-140-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

description	pid	process	target process
PID 4320 set thread context of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

pid	process
4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

pid	process
4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

description	pid	process	target process
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 4320 wrote to memory of 1656	4320	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
"C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
2⤵
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-132-0x0000000000000000-mapping.dmp

Download
memory/1656-133-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1656-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-137-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1656-138-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1656-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4320-135-0x0000000002250000-0x0000000002254000-memory.dmp

Filesize
16KB

Download