264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d

General

Target

264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
Size

13KB
MD5

f2eefab06d4fcfcdbacef469d8177c14
SHA1

55d1b9121b99a8336d5b34f1b644fe1154e1072d
SHA256

264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d
SHA512

5af69f551b07e933f651f2fa958506d6d250190c98b8ac43c8e83cd6ea3ce74bb706cd615c0e92714ab218c9d2e0878bc107f949b2bdff8efb0961c114201dd4
SSDEEP

384:CgIf066Mg1OwlORUJzZ+w0wSMaGCq3SG+cztw9Zb:C7M66Mg8Kt+wInXklvUb

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2500	gth72326.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3144-132-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4040-134-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/3144-135-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
2500	gth72326.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmsfc1.dll	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
File opened for modification	C:\Windows\SysWOW64\mmsfc1.dll	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
File created	C:\Windows\SysWOW64\ComRes.dll	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
File created	C:\Windows\SysWOW64\gth72326.exe	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fonts\ComRes.dll	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
File created	C:\Windows\fonts\gth72326.ttf	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
File created	C:\Windows\fonts\gth72326.fon	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
2500	gth72326.exe
2500	gth72326.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2500	gth72326.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4040	3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe	80
PID 3144 wrote to memory of 4040	3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe	80
PID 3144 wrote to memory of 4040	3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe	80
PID 3144 wrote to memory of 2500	3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe	88
PID 3144 wrote to memory of 2500	3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe	88
PID 3144 wrote to memory of 2500	3144	264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe	88

C:\Users\Admin\AppData\Local\Temp\264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
"C:\Users\Admin\AppData\Local\Temp\264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3144
- C:\#.pif
  C:\#.pif
  2⤵
  PID:4040
- C:\Windows\SysWOW64\gth72326.exe
  C:\Windows\system32\gth72326.exe C:\Windows\fonts\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\264a34f4975d86b3b13785d46a97c465ae332160c70f901cff050e1b0e75a20d.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\ComRes.dll

Filesize
11KB

MD5
9f1fc0dc566ab8772ebe8f3d115a876c

SHA1
3df5c2fadf7f980b0fef3c9c8d73aafab563f0e9

SHA256
b22a85d5313c3ffa24a5c11b2a68df42142f8c26838c6496b4256cad572822d7

SHA512
7724d699c0c7a955aec6085af00853248b84b2b04335ae4d0b8ca7c519cd9e46f719b1d5e9a5acb8b8f0f7914330c7ee14b6ffd2f55ea7d61ac8ce2cce108908

Download Submit
C:\Windows\SysWOW64\gth72326.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
C:\Windows\SysWOW64\gth72326.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
C:\Windows\SysWOW64\mmsfc1.dll

Filesize
48KB

MD5
98c499fccb739ab23b75c0d8b98e0481

SHA1
0ef5c464823550d5f53dd485e91dabc5d5a1ba0a

SHA256
d9d8ce1b86b3978889466ab1b9f46778942d276922bf7533327a493083913087

SHA512
9e64ac13e18ab0a518bb85b6612520645b5ab2c9a5359ced943813ba7344714999f25ba0e52240ad2d0c2fefc76552ff43173adc46334ff0b5dba171fb58e4e6

Download Submit
C:\Windows\fonts\ComRes.dll

Filesize
11KB

MD5
9f1fc0dc566ab8772ebe8f3d115a876c

SHA1
3df5c2fadf7f980b0fef3c9c8d73aafab563f0e9

SHA256
b22a85d5313c3ffa24a5c11b2a68df42142f8c26838c6496b4256cad572822d7

SHA512
7724d699c0c7a955aec6085af00853248b84b2b04335ae4d0b8ca7c519cd9e46f719b1d5e9a5acb8b8f0f7914330c7ee14b6ffd2f55ea7d61ac8ce2cce108908

Download Submit
memory/2500-137-0x0000000000000000-mapping.dmp

Download
memory/2500-142-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3144-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3144-135-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4040-133-0x0000000000000000-mapping.dmp

Download
memory/4040-134-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing