9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414

General

Target

9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
Size

335KB
MD5

0ce4b9edc66c5949045149eebc281fd9
SHA1

dff48bd39b57a579d2290a27a2ec91add7b61c6e
SHA256

9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414
SHA512

eaebccf3869eff1834a4b5ca7a7f57f1718e2154624cc9bcfef6e9cae6abfdee33216b192a1cd29c55cae6b57833deae55e24d445e85e28d657e5c3a0f175d3d
SSDEEP

6144:9G1Hh26baQcVXRhM1O0x/lZklPWY9y8pBNdwWmAG72IQnSwfPGTzE5zX////////:9WoFLnhM1NHA+OlGAGanHPEzo

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3820-134-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3820-135-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe

pid	process
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
3820	9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe

C:\Users\Admin\AppData\Local\Temp\9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe
"C:\Users\Admin\AppData\Local\Temp\9f5ea4449daaa67e8af9a9a7fbdfd53646e20c75d2e2f69fcd8ca6387414d414.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-132-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3820-133-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3820-134-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3820-135-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads