42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954

Analysis

max time kernel
151s
max time network
165s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
Size 77KB
Sample221126-1ep5eafd43
SHA256 42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954
MD5 aa8a75f9921b5bd121e7b8def42eda58
SHA1 f3e16cf6719f76208b6d57b5865d55731090d9a5
SHA512 32f8637e0bcba90067e422ea369baad02b7fe15c5b4eb5bc72285cda1267780adbaed5cdd2b8586da0874346dccfb798c22f302525a1c805cbf5e4f111d75a83
SSDEEP 768:qHoxQJoOttDax40RHl1ZcC9k3SVXA6mF0vm86U2MC73uw1vTVZf9YsGwzi:qISJOfDcC9jXA6mjfuwpvFlGr
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1684-58-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1684-60-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1684-61-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1684-65-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1684-67-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1684-66-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1684-68-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
1684	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
1684	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
1684	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
1684	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
1684	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
1684	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28
PID 1488 wrote to memory of 1684	1488	42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe	28

C:\Users\Admin\AppData\Local\Temp\42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
"C:\Users\Admin\AppData\Local\Temp\42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe
  "C:\Users\Admin\AppData\Local\Temp\42f714dcfd3081c98da5bc6d6862390da6a93891109154c6d799407b22f1f954.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Download

memory/1488-62-0x0000000000240000-0x0000000000244000-memory.dmp

Download

memory/1684-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Download

memory/1684-57-0x0000000000400000-0x0000000002B10000-memory.dmp

Download

memory/1684-58-0x0000000000400000-0x0000000002B10000-memory.dmp

Download

memory/1684-60-0x0000000000400000-0x0000000002B10000-memory.dmp

Download

memory/1684-61-0x0000000000400000-0x0000000002B10000-memory.dmp

Download

memory/1684-65-0x0000000000400000-0x0000000002B10000-memory.dmp

Download

memory/1684-67-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/1684-66-0x0000000000400000-0x0000000002B10000-memory.dmp

Download

memory/1684-68-0x0000000000400000-0x000000000040A000-memory.dmp

Download