364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745

General

Target

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
Size

1.4MB
MD5

79a3ad7f4e0101dba86741924d430982
SHA1

54e1f654acbc89063ae1d1da60eb9c6ace120a92
SHA256

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745
SHA512

4fee7f49410af091bbb508e0130b040567868c67ae37bbdca555a0481abf8191744bb79678bdc14c4a37f9072cf0839fa408555605abd345826535880c3ece9a
SSDEEP

24576:xauGdCtDOcHCM1adVyi7BJ/rmp668nWII2WSuGOh8rm:AuzpOciDyEJip6dnhJWSuTQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1784-57-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1784-62-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1784-63-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1784-64-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1784-65-0x0000000000400000-0x0000000000768000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

description	pid	process	target process
PID 1976 set thread context of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

pid	process
1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
1784	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
1784	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
1784	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
1784	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

description	pid	process	target process
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 1976 wrote to memory of 1784	1976	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

C:\Users\Admin\AppData\Local\Temp\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
"C:\Users\Admin\AppData\Local\Temp\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
"C:\Users\Admin\AppData\Local\Temp\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe"
2⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-57-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1784-58-0x0000000000740AB0-mapping.dmp

Download
memory/1784-61-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1784-62-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1784-63-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1784-64-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1784-65-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1976-56-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/1976-60-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads