62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4

General

Target

62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe
Size

452KB
MD5

c2d6630d2f5ab5ab7956ceddb1ac25db
SHA1

10b4264560acaec1738b93aa62f13f73bbdb4186
SHA256

62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4
SHA512

2e29bb16ca9358e2e6384c8ae200ef61052fbbb046da9da08658ddf66e602b8820b81789fdc8aa115d958bf3b957c41c24c105750aa1661839317045dd8aeda2
SSDEEP

12288:fYGsisbFc35RXv+CJ8ekku/tc5iUDWrfSmP6/:g1bFcp9vJaOChPC

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1780-56-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1780-59-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1780-60-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1780-67-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1780 set thread context of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe
952	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe
1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1112 wrote to memory of 1780	1112	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	28
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 1780 wrote to memory of 952	1780	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	29
PID 952 wrote to memory of 1272	952	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	13
PID 952 wrote to memory of 1272	952	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	13
PID 952 wrote to memory of 1272	952	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	13
PID 952 wrote to memory of 1272	952	62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\62b08b8eafc969d2c918023c5b1f002395b00b0a8d79040ba98c468ccec87ee4.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/952-65-0x0000000000407A4D-mapping.dmp

Download
memory/952-68-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/952-69-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/952-73-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1112-63-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1272-70-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1780-57-0x000000000042B210-mapping.dmp

Download
memory/1780-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1780-59-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1780-60-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1780-67-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing