b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821

General

Target

b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
Size

2.7MB
MD5

8f31d971b29887cf86407da990d89d02
SHA1

acfd5d01c7c786a8f0192604740f699bd8e6cca7
SHA256

b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821
SHA512

69e7181f15051e88a07910176027432e47f23547e24f25d0b7b720aed28dd3a5a16bb3605475daa8f240d5c9f2f04f0b2cb5cea6b2b6330703f5ea8973b55294
SSDEEP

49152:gIuzz/kS+zpZjV2vFXw9qh8lQyGiGVz+s8KuqGaX0ToIBAUZLYxgw:wzzsS+zpFYZw99nGRuJBAUZLQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2220-132-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-135-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-134-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-136-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-137-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-139-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-141-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-143-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-145-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-147-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-149-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-151-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-153-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-155-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-157-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-159-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-161-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-163-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-165-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-167-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-169-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-171-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-173-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-175-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-177-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2220-178-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\YCZMGLQ.ZXY	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
File opened for modification	C:\Windows\SysWOW64\YCZMGLQ.ZXY	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
2220	b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe

C:\Users\Admin\AppData\Local\Temp\b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe
"C:\Users\Admin\AppData\Local\Temp\b67fefe697d0c2e2cafac8d6c9f0b9a4fd4b4e2975150201048dba390245e821.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-132-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-135-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-134-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-136-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-137-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-139-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-141-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-143-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-145-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-147-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-149-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-151-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-153-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-155-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-157-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-159-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-161-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-163-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-165-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-167-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-169-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-171-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-173-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-175-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-177-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2220-178-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing