defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305

General

Target

defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe
Size

1.0MB
MD5

45d5094054b9953218d927ddad26e325
SHA1

a717ae0c907ce22effaa0c233e205b8a7d3e7a4d
SHA256

defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305
SHA512

7c7f8d571a9e1a401ffee2715e136589b2b35bbab521a65b0404b444934ef501c8fff9afb221cb32c194ed8d2c1b029fa328c7e9098f404cf9ce4590f2074a52
SSDEEP

24576:NJLdAsp6Mi2MkCT4KMC+eN4c1RTaH2ZZwiy2M7BtAkn1dYila:nLdAJMkkCTFGGE2kz2m/AIK

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1388-69-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/1388-71-0x0000000000400000-0x0000000000645000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe
1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 892	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	30
PID 1724 wrote to memory of 892	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	30
PID 1724 wrote to memory of 892	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	30
PID 1724 wrote to memory of 892	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	30
PID 1724 wrote to memory of 952	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	29
PID 1724 wrote to memory of 952	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	29
PID 1724 wrote to memory of 952	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	29
PID 1724 wrote to memory of 952	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	29
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28
PID 1724 wrote to memory of 1388	1724	defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe	28

C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe
"C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe
  "C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe"
  2⤵
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe
  "C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe"
  2⤵
  PID:952
- C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe
  "C:\Users\Admin\AppData\Local\Temp\defbdf2eb935f3bf039cb37efac9de76ab8e2706b518db2a243fdec55580e305.exe"
  2⤵
  PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1388-58-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-60-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-67-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-63-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-62-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-57-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-68-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-69-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1388-71-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1724-65-0x0000000000260000-0x0000000000264000-memory.dmp

Filesize
16KB

Download
memory/1724-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing