47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08

General

Target

47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
Size

2.3MB
MD5

ebc54e88a8aac16f8cdf2dc3391b389c
SHA1

4e6832a09df6cf6319c3998f2ad5b2c08e41198c
SHA256

47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08
SHA512

2c4ff7bf32747d7e6e2b82a7fdceed37a9047c90a48d64a2e270e8c05e2e9e9ac96ead8f67c0131e1560796846474b0cbdb8618b27b9ba48fdb9337546b09131
SSDEEP

49152:UmjHkb9DZfQ2AyoXZ9i0hanVA/rFDY96supFG:3EZDJ9op9XanV+ry6supF

Score

8^/10

upx vmprotect

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts.ics	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts.ics	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1808-56-0x0000000002010000-0x0000000002082000-memory.dmp	upx
behavioral1/memory/1808-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-99-0x0000000002010000-0x0000000002082000-memory.dmp	upx
behavioral1/memory/1808-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-101-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1808-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1808-55-0x0000000000400000-0x000000000067F000-memory.dmp	vmprotect
behavioral1/memory/1808-98-0x0000000000400000-0x000000000067F000-memory.dmp	vmprotect
behavioral1/memory/1808-103-0x0000000000400000-0x000000000067F000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

pid process

1808 47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

pid process

1808 47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

pid	process
1808	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
1808	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
1808	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
1808	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
1808	47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe

C:\Users\Admin\AppData\Local\Temp\47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe
"C:\Users\Admin\AppData\Local\Temp\47112d76f41b2eb912eef8a21181361d63d9d2c28d0063f78da1278878b4fa08.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1808-55-0x0000000000400000-0x000000000067F000-memory.dmp

Filesize
2.5MB

Download
memory/1808-56-0x0000000002010000-0x0000000002082000-memory.dmp

Filesize
456KB

Download
memory/1808-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-99-0x0000000002010000-0x0000000002082000-memory.dmp

Filesize
456KB

Download
memory/1808-98-0x0000000000400000-0x000000000067F000-memory.dmp

Filesize
2.5MB

Download
memory/1808-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-101-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1808-103-0x0000000000400000-0x000000000067F000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads