9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2

General

Target

9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe
Size

1.4MB
MD5

819bd029401e312bb65397034521dee6
SHA1

fd80808c307b829f1bb480174b55875560d7262c
SHA256

9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2
SHA512

715d24c5b40ecc146281a1bac30bd8d4afac45986621fcc118d53101ad0d26496788f98c6ccc753ae7930d94eb3f34bcfa57e9cbec062efaf7534ff93185b2a2
SSDEEP

24576:oc//////DEfGzAiQHk5M/rbTdYREeGAvcUeNJgJv42gRHMmTmaTA2HRYrI4:oc//////Dm5Hv7sevNyyBRHtKKFu0

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/684-61-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-64-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-63-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-66-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-65-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-68-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-70-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-72-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-74-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-76-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-78-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-80-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-82-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-84-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-86-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-88-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-90-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-92-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-94-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-96-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-98-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-100-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-102-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-104-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-106-0x0000000000240000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/684-108-0x0000000000240000-0x000000000027D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ÎÒµÄÆô¶¯Ïî = "C:\\Documents and Settings\\Administrator\\¡¸¿ªÊ¼¡¹²Ëµ¥\\³ÌÐò\\Æô¶¯\\IEXPLORE.exe"	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1056 set thread context of 684	1056	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
684	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
684	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
684	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe
684	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe
684	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe
684	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 684	1056	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe	28
PID 1056 wrote to memory of 684	1056	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe	28
PID 1056 wrote to memory of 684	1056	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe	28
PID 1056 wrote to memory of 684	1056	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe	28
PID 1056 wrote to memory of 684	1056	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe	28
PID 1056 wrote to memory of 684	1056	9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe	28

C:\Users\Admin\AppData\Local\Temp\9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe
"C:\Users\Admin\AppData\Local\Temp\9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe
  C:\Users\Admin\AppData\Local\Temp\9b97c261d2749c01618867d135cf747f4520fbc67ae201d053a5f8dcb5244fa2.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-54-0x0000000000400000-0x00000000006FC000-memory.dmp

Filesize
3.0MB

Download
memory/684-56-0x0000000000400000-0x00000000006FC000-memory.dmp

Filesize
3.0MB

Download
memory/684-59-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/684-60-0x0000000000400000-0x00000000006FC000-memory.dmp

Filesize
3.0MB

Download
memory/684-61-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-64-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-63-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-66-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-65-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-68-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-70-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-72-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-74-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-76-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-78-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-80-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-82-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-84-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-86-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-88-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-90-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-92-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-94-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-96-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-98-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-100-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-102-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-104-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-106-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-107-0x0000000000400000-0x00000000006FC000-memory.dmp

Filesize
3.0MB

Download
memory/684-108-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/684-109-0x0000000000400000-0x00000000006FC000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing