b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e

General

Target

b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
Size

73KB
MD5

eecb67670f21b27b4a4f75651d2774cc
SHA1

b4b7f1d0f87fdf74e05c71facf095d0ccc22a726
SHA256

b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e
SHA512

f30f75577a84dcaa4a1780832e06be03f39a6852a89f2475016cbfb03fa58d3043c00bfb2c3316336f8ff9d9af9e5e9cf5c4263f97a3a3e4079a1e4407c84e1c
SSDEEP

1536:V8XuhtuByoNPzykxidXg0Xhj7r7RobKhRLLjNj:VVsbNP+kMdQ01378KhRXZ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2648-132-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2648-133-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe

description	ioc	process
File opened for modification	C:\Windows\RCLHfsoVKo	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\oHjigD3tfi	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\5pmmsMdNFo	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\dWmqNQboc	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\8nngEoL	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\VfboROYGFY	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\8UHe2P	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\2Qvsv	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\WtQPnivy6	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\mrq5K4P	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\CVkCg6GGje	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\tNbbFn	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\uhbYm	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\sGVbix	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\GcCSso	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\VQjKpNoC	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\Hvo7kUU	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\7TtKhaDt2e	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\k1atV	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\4IWYB	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\pyxFWS2S	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\eDFchX7Gu	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\OmW4hGUmrl	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\sXQAwehfl	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\Iul4M	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\bnGVMejdQS	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\Gniqh2	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\1Vi1Y22E	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\qRgYu374	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\NxQK1	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\gUu2n5	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\a1PWcH	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\XJ5lf4C	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\1euCH41Y2	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\aPGWPE	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\8xuuEFl	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\WXtYjgGvWB	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\Sg8JQhcb	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\7msMUWiACu	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\SnAF2h	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\dTU6n3qcO	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\mYDaRfcd	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\TOx3x5Y	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\bMgNPtp6	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\1fQKO	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\FtuUKI7tLO	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\tfHvVM	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\Mv8FNpV2hK	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\l2X358N	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\nJtf64j	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\hwvfAj	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\wkxxch3S	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\GDfBH3qm	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\T8X7Pr8	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\pA8P1O	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\1cUWTTc4e	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\ABrHyOQF	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\5hJOk1N	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\lnE1ok7SVo	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\oemKQGlTS	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\eVOOvF	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\Y4uGYpB	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\GJX5lU7	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
File opened for modification	C:\Windows\3tvJyeq	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3664 2648 WerFault.exe b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe

pid	pid_target	process	target process
3664	2648	WerFault.exe	b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe

C:\Users\Admin\AppData\Local\Temp\b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe
"C:\Users\Admin\AppData\Local\Temp\b5372ee1d63f8381c267024742424c9a107db7bcfeb9225c6855df8e6b95d50e.exe"
1⤵
- Drops file in Windows directory
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 216
2⤵
- Program crash
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2648 -ip 2648
1⤵
PID:1028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2648-133-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing