63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1

General

Target

63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
Size

334KB
MD5

3f629c5b958845119f21931da1473c6c
SHA1

cdce405920e99699740d89599b9ec7f40e9c806f
SHA256

63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1
SHA512

85192ff9caa98eaf706537a6ece20b7da994423afdf59c12ce70fd5cfc4150bf4d8517851f274956c24ab660c732aa13da64e58d9acddcf954853855f722a528
SSDEEP

6144:92C4B23wyiZ9/G65p/lPeKzXoXsHqjJtrxCW4zfwAHeLQJk8UTEmrKo:sCEyiX/G65JZkXsHWtIpzd+LikrKo

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4600-135-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/4600-136-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe

pid	process
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
4600	63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe

C:\Users\Admin\AppData\Local\Temp\63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe
"C:\Users\Admin\AppData\Local\Temp\63294aab3f0645fdc488074e43819182d8b621c3c4bfd24f999d2aa5e30c3cc1.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4600-133-0x00000000008E0000-0x0000000000915000-memory.dmp

Filesize
212KB

Download
memory/4600-132-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4600-134-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4600-135-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4600-136-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads