5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c

General

Target

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
Size

81KB
MD5

a6f154313a388ef98c3057480e5ab0ce
SHA1

66a31cf5b42ac12b3fd7e2b56bea9d436bb8a5f5
SHA256

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c
SHA512

5b4a67a83746f1b7e67ed41f2c14ffe66580a6187c9e34d5d0efb2146a846cd32504a30da8f37fbdb291738a7f3770a5ab56372c6c84201c6eb24b0d200f83db
SSDEEP

1536:AZtB3QtVbDkyJooi5TJc99v34PQEc4PpSo4oAWX76DfNNELk645jf:Af3QtVHkyCy9xIoGpxMWrgbj5z

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3684-132-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/3684-135-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

description	pid	process	target process
PID 3684 set thread context of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

pid	process
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
1156	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

description	pid	process	target process
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 3684 wrote to memory of 1156	3684	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

C:\Users\Admin\AppData\Local\Temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
"C:\Users\Admin\AppData\Local\Temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3684

\??\c:\users\admin\appdata\local\temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
"c:\users\admin\appdata\local\temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe"
2⤵
- Suspicious use of FindShellTrayWindow
PID:1156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-133-0x0000000000000000-mapping.dmp

Download
memory/1156-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1156-136-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1156-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1156-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1156-139-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3684-132-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3684-135-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads