2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac

Analysis

max time kernel
169s
max time network
185s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe
Size

1.7MB
MD5

b629f2dc8e63ab5d484aeb783a4d7516
SHA1

a408389e4f0b66899a4e8ccad6eb3b33cc58b38c
SHA256

2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac
SHA512

e49a50c44ddbff889ef18f2a9820582bcc148c160d854f2c7ac614730f5588718ae8fdd7082864ae244774859c7c09a3ba750be0526e2b6fb0f0dc72a7065556
SSDEEP

49152:THvo+lE9zIEL6hFldCZpu2sp8O2o+2JxiKIDhX7ppg:THvo6IIVlEZ5O2oRLQhX7v

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1904-73-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1904-76-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1904-75-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1904-78-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1904-82-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1904-85-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1904-87-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1904-111-0x0000000000400000-0x00000000006B3000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	checkip.dyndns.org

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 580 set thread context of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 set thread context of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 set thread context of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	svchost.exe
1904	svchost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 992 wrote to memory of 580	992	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	28
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1904	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	29
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1220	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	30
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32
PID 580 wrote to memory of 1036	580	2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe	32

C:\Users\Admin\AppData\Local\Temp\2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe
"C:\Users\Admin\AppData\Local\Temp\2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe
  C:\Users\Admin\AppData\Local\Temp\2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1904
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe (null)
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe ext "C:\Users\Admin\AppData\Local\Temp\2e5e14b3dafa9a49d018f8647047b280f68a7c1b0c81ddbb83184c1adb8f4eac.exe"
    3⤵
    PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-55-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-56-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-58-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-60-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-62-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-64-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-66-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-67-0x0000000000402B67-mapping.dmp

Download
memory/580-70-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-71-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/580-106-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/992-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/1036-95-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1036-97-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1036-109-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1036-108-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1036-104-0x00000000004164A1-mapping.dmp

Download
memory/1036-103-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1036-101-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1036-100-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1220-92-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1220-79-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1220-110-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1220-88-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1220-90-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1220-80-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1220-93-0x0000000000407CBE-mapping.dmp

Download
memory/1220-84-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1220-98-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1904-73-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-82-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-78-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-76-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-85-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-72-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-75-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-77-0x00000000006B0800-mapping.dmp

Download
memory/1904-87-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1904-111-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download