ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502

General

Target

ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
Size

1.8MB
MD5

83a67b3bfe946eb4fda0344e14f52a3f
SHA1

daa9368cb6914b26a6ccb22664fbb0e69f9c825e
SHA256

ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502
SHA512

da658ebbd88d7c91c4b2b48f1d5140cf0eedbbe06c3e259cc00b90854a5c339ab1e78ae0ba991bbf4ecb87a68db220dd5e7a262d9b73ca3c5e307ad921985220
SSDEEP

49152:mxfvukrD927bRgOIk/1+e/uq2oGSdGCoC3/+S1Swi:ml/rDg7yOIkYsuq2oGSYb5S

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2016-55-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-56-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-57-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-59-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-61-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-63-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-65-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-67-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-69-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-71-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-73-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-75-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-77-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-79-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-81-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-83-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-85-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-87-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-89-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-91-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-95-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-93-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-97-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-105-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/2016-104-0x0000000000400000-0x0000000000759000-memory.dmp	upx
behavioral1/memory/2016-107-0x0000000000400000-0x0000000000759000-memory.dmp	upx
behavioral1/memory/2016-108-0x0000000010000000-0x000000001003F000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2016-98-0x0000000002770000-0x000000000293D000-memory.dmp	vmprotect
behavioral1/memory/2016-100-0x0000000002770000-0x000000000293D000-memory.dmp	vmprotect
behavioral1/memory/2016-106-0x0000000002770000-0x000000000293D000-memory.dmp	vmprotect

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe

pid process

2016 ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1948	AUDIODG.EXE
Token: 33	1948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1948	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe

pid process

2016 ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe

pid process

2016 ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe

pid	process
2016	ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
2016	ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
2016	ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
2016	ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
2016	ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe

C:\Users\Admin\AppData\Local\Temp\ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
"C:\Users\Admin\AppData\Local\Temp\ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-56-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-57-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-59-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-61-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-63-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-65-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-67-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-69-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-71-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-73-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-75-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-77-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-79-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-81-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-83-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-85-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-87-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-89-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-91-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-95-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-93-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-97-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-98-0x0000000002770000-0x000000000293D000-memory.dmp

Filesize
1.8MB

Download
memory/2016-100-0x0000000002770000-0x000000000293D000-memory.dmp

Filesize
1.8MB

Download
memory/2016-105-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-104-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/2016-106-0x0000000002770000-0x000000000293D000-memory.dmp

Filesize
1.8MB

Download
memory/2016-107-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/2016-108-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2016-109-0x0000000002770000-0x000000000293D000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads