3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255

General

Target

3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
Size

99KB
MD5

35f9e9327bc14a6dc76ad20933d7163c
SHA1

71b96eeb4205c52f53d0c8ad83c99b5e3a60032a
SHA256

3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255
SHA512

c0aff5e469244cd3be123e75cdc51dd669da92c54d6074fa8d4b652617d0b621e809135d40f898e9c59d821ccaa85b7813f5be8df6363a6f1c77888875e0f626
SSDEEP

1536:ef3tItHjl1GmEhZGkS5jDNVlkubUz+mAjGEo+VJHm195uxf2iH1oAbrG27V:y3tO1YZOXOxz+mAEWHmpUN1o+TV

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1504-56-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

pid process

1504 3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

pid	process
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

description pid process

Token: SeDebugPrivilege 1504 3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

pid process

1504 3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

description	pid	process
Token: SeDebugPrivilege	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe

description	pid	process	target process
PID 1504 wrote to memory of 368	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	wininit.exe
PID 1504 wrote to memory of 368	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	wininit.exe
PID 1504 wrote to memory of 368	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	wininit.exe
PID 1504 wrote to memory of 368	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	wininit.exe
PID 1504 wrote to memory of 368	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	wininit.exe
PID 1504 wrote to memory of 368	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	wininit.exe
PID 1504 wrote to memory of 368	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	wininit.exe
PID 1504 wrote to memory of 384	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	csrss.exe
PID 1504 wrote to memory of 384	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	csrss.exe
PID 1504 wrote to memory of 384	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	csrss.exe
PID 1504 wrote to memory of 384	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	csrss.exe
PID 1504 wrote to memory of 384	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	csrss.exe
PID 1504 wrote to memory of 384	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	csrss.exe
PID 1504 wrote to memory of 384	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	csrss.exe
PID 1504 wrote to memory of 420	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	winlogon.exe
PID 1504 wrote to memory of 420	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	winlogon.exe
PID 1504 wrote to memory of 420	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	winlogon.exe
PID 1504 wrote to memory of 420	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	winlogon.exe
PID 1504 wrote to memory of 420	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	winlogon.exe
PID 1504 wrote to memory of 420	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	winlogon.exe
PID 1504 wrote to memory of 420	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	winlogon.exe
PID 1504 wrote to memory of 464	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	services.exe
PID 1504 wrote to memory of 464	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	services.exe
PID 1504 wrote to memory of 464	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	services.exe
PID 1504 wrote to memory of 464	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	services.exe
PID 1504 wrote to memory of 464	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	services.exe
PID 1504 wrote to memory of 464	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	services.exe
PID 1504 wrote to memory of 464	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	services.exe
PID 1504 wrote to memory of 480	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsass.exe
PID 1504 wrote to memory of 480	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsass.exe
PID 1504 wrote to memory of 480	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsass.exe
PID 1504 wrote to memory of 480	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsass.exe
PID 1504 wrote to memory of 480	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsass.exe
PID 1504 wrote to memory of 480	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsass.exe
PID 1504 wrote to memory of 480	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsass.exe
PID 1504 wrote to memory of 488	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsm.exe
PID 1504 wrote to memory of 488	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsm.exe
PID 1504 wrote to memory of 488	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsm.exe
PID 1504 wrote to memory of 488	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsm.exe
PID 1504 wrote to memory of 488	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsm.exe
PID 1504 wrote to memory of 488	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsm.exe
PID 1504 wrote to memory of 488	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	lsm.exe
PID 1504 wrote to memory of 596	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 596	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 596	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 596	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 596	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 596	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 596	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 676	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 676	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 676	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 676	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 676	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 676	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 676	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 752	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 752	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 752	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 752	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 752	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 752	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 752	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe
PID 1504 wrote to memory of 820	1504	3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1940

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1112

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe
"C:\Users\Admin\AppData\Local\Temp\3e56245df4bbc077c958e02d5fe6de63c7d997e9b3f2234aa0b87a2d75a01255.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1416

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1888

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1196

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-56-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads