b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7

General

Target

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
Size

1.4MB
MD5

ad5d0f6e9cd5d646395ff1ef7a4c32b9
SHA1

b3babfcdd3c06e87048a6f1e11544568099692f3
SHA256

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7
SHA512

2f9034addee9609f5dc9afb10fd992d51162cc3efcfe0db6348a92c4584c1f1ba3c52c54bb30aca1cacdf3f1bae7ec107cfb97404a1619c03b5582e105cdeab9
SSDEEP

24576:wQfFzvwAEUQS4vEfG1667K79HlLG5QeXrWlMrPL/ZEDsZo/UwZUTBhuS9OPK:P5vwABQSeMc6B7Rli5QeVL/ZEoZo/f07

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/732-56-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/732-60-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/732-61-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/732-62-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/732-63-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/732-64-0x0000000000400000-0x0000000000768000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

description	pid	process	target process
PID 1188 set thread context of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exeb42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

pid	process
1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
732	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
732	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
732	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
732	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

description	pid	process	target process
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 1188 wrote to memory of 732	1188	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

C:\Users\Admin\AppData\Local\Temp\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
"C:\Users\Admin\AppData\Local\Temp\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Local\Temp\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
"C:\Users\Admin\AppData\Local\Temp\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe"
2⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-56-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/732-57-0x0000000000740AB0-mapping.dmp

Download
memory/732-59-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/732-60-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/732-61-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/732-62-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/732-63-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/732-64-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads