b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821

General

Target

b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
Size

2.7MB
MD5

8f31d971b29887cf86407da990d89d02
SHA1

acfd5d01c7c786a8f0192604740f699bd8e6cca7
SHA256

b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821
SHA512

69e7181f15051e88a07910176027432e47f23547e24f25d0b7b720aed28dd3a5a16bb3605475daa8f240d5c9f2f04f0b2cb5cea6b2b6330703f5ea8973b55294
SSDEEP

49152:gIuzz/kS+zpZjV2vFXw9qh8lQyGiGVz+s8KuqGaX0ToIBAUZLYxgw:wzzsS+zpFYZw99nGRuJBAUZLQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1516-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-76-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-80-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-82-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-86-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-88-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-92-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-90-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-94-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-100-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1516-101-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\YCZMGLQ.ZXY	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
File opened for modification	C:\Windows\SysWOW64\YCZMGLQ.ZXY	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1516	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1516	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1516	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
1516	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
1516	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

C:\Users\Admin\AppData\Local\Temp\b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
"C:\Users\Admin\AppData\Local\Temp\b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1516-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-70-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-76-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-74-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-72-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-80-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-82-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-86-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-88-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-92-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-90-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-94-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-98-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-96-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-100-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1516-101-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing