44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d

General

Target

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
Size

1.4MB
MD5

1d5060bb33d73839800c4d469dc01201
SHA1

a44cd4ca0058e0aebc09511931119a446557576f
SHA256

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d
SHA512

49a0eed64874ad1ba63ba8cb9d8c623de7145ed0aec53dca4f06d60ea993e6fe66c9405b11e3c7ca76263aa143cb6513f7ff7879bcd2847703fc79fcff75092a
SSDEEP

24576:rnFmIsnO/BKs78e74A+x0lWqwSJvyo4bS5VqsV4XHiELU5/TdNFjacb9wpSYgVkO:rnsOZjwe7usdYtbxvU5/7xwpekYXfyXG

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1160-57-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1160-62-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1160-63-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1160-64-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1160-65-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1160-66-0x0000000000400000-0x0000000000768000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

description	pid	process	target process
PID 288 set thread context of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

pid	process
288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
1160	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
1160	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
1160	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
1160	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

description	pid	process	target process
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 288 wrote to memory of 1160	288	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

C:\Users\Admin\AppData\Local\Temp\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
"C:\Users\Admin\AppData\Local\Temp\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Local\Temp\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
"C:\Users\Admin\AppData\Local\Temp\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe"
2⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-56-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/288-60-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1160-57-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1160-58-0x0000000000740AB0-mapping.dmp

Download
memory/1160-61-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1160-62-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1160-63-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1160-64-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1160-65-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1160-66-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads