562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb

Analysis

max time kernel
166s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
Size

65KB
MD5

52849cc043bf31bd8c0199717e878b49
SHA1

99dd1f392c69a852770e16ea8357978b0ce47039
SHA256

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb
SHA512

7f3ccf1c5c28d3038aff8fa42200f1dea94456a8f1bfb7c2d0a47bb855a76fda6a2663aceefc9e4cd5c8b65a1746db7d0f4d6336ece780b5c1631207d9b4e1c0

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1948-130-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4476-132-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1948-133-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4476-136-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/4476-137-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/4476-138-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/4476-139-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

description	pid	process	target process
PID 1948 set thread context of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

pid	process
1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

pid process

1948 562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

description	pid	process	target process
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 1948 wrote to memory of 4476	1948	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
"C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
2⤵
PID:4476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-130-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1948-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1948-135-0x00000000006E0000-0x00000000006E4000-memory.dmp

Filesize
16KB

Download
memory/4476-131-0x0000000000000000-mapping.dmp

Download
memory/4476-132-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/4476-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4476-137-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/4476-138-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/4476-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download