6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74

General

Target

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe
Size

932KB
MD5

241f3cce5dcb1d5b9c525c654426fa16
SHA1

240c8c6b25a0e4105b3933e6d33baedbd4be94a8
SHA256

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74
SHA512

b8c3e20bf65e7deed2ab047806417a952e791f7f9058fb5fa54db59568062cc5d086c170857952bd2c4f690e6b676b6012fb3fbbfa52e0ae10db387003814d85
SSDEEP

12288:ZSFIeCGLwUZhQjzqXJsFP6CgZdr9CpqEzFdcLVNNl0fmjKR3KjKSLt8:ZoWvU/m+opqEzFdcLVNPUm03KjzLt

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2212-135-0x0000000000400000-0x0000000000635000-memory.dmp	upx
behavioral2/memory/2212-136-0x0000000000400000-0x0000000000635000-memory.dmp	upx
behavioral2/memory/2212-137-0x0000000000400000-0x0000000000635000-memory.dmp	upx
behavioral2/memory/2212-138-0x0000000000400000-0x0000000000635000-memory.dmp	upx
behavioral2/memory/2212-139-0x0000000000400000-0x0000000000635000-memory.dmp	upx
behavioral2/memory/2212-140-0x0000000000400000-0x0000000000635000-memory.dmp	upx
behavioral2/memory/2212-141-0x0000000000400000-0x0000000000635000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE"	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe

description	pid	process	target process
PID 5112 set thread context of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

pid	process
2212	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
2212	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
2212	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
2212	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

pid process

2212 6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

pid	process
5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe
2212	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
2212	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe

description	pid	process	target process
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
PID 5112 wrote to memory of 2212	5112	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe	6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE

C:\Users\Admin\AppData\Local\Temp\6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe
"C:\Users\Admin\AppData\Local\Temp\6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE
"C:\Users\Admin\AppData\Local\Temp\6445c6f0a53b334a93c6e5e36fd4f5aaa1b7601fcbbfe4291c854cd3b1072e74.EXE"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-134-0x0000000000000000-mapping.dmp

Download
memory/2212-135-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2212-136-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2212-137-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2212-138-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2212-139-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2212-140-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2212-141-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads