99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88

General

Target

99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe
Size

2.0MB
MD5

3e5c3a64ca54c7f366735b44c02b8b41
SHA1

df7c02c777a355750596b602a62f6adcbaad06f4
SHA256

99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88
SHA512

db12bf912182e9992f28f9f1b56460b3b4ee1b1b380d54b223cb9000258d7d8ce3ec67bee03391049f14c6d09b71dcbf2154500b42328ce2619471122b5b849e
SSDEEP

49152:agQ1vwmwy6YWzQoHy8+a5Bjlm3RZVYxStrVQhcOdTUMBEzKdipHRDyI2GwTGE:aTvwhYW28+a7B45YxStrVQhcOdTUfudp

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1368-55-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-56-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-59-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-57-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-63-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-61-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-67-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-65-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-69-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-73-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-71-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-77-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-75-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-81-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-85-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-83-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-79-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-87-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-89-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-93-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-95-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-91-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-97-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-100-0x0000000000400000-0x000000000073F000-memory.dmp	upx
behavioral1/memory/1368-101-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1368-107-0x0000000000400000-0x000000000073F000-memory.dmp	upx
behavioral1/memory/1368-108-0x0000000010000000-0x000000001003F000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1368-98-0x0000000002920000-0x0000000002AED000-memory.dmp	vmprotect
behavioral1/memory/1368-102-0x0000000002920000-0x0000000002AED000-memory.dmp	vmprotect
behavioral1/memory/1368-103-0x0000000002920000-0x0000000002AED000-memory.dmp	vmprotect

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe

pid	process
1368	99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe
1368	99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe
1368	99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe
1368	99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe
1368	99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe

C:\Users\Admin\AppData\Local\Temp\99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe
"C:\Users\Admin\AppData\Local\Temp\99bd9026f48647e226c96b3a8a88ea895241e91dad5343213a5f4fd3e2e31d88.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-56-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-59-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-57-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-63-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-61-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-67-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-65-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-69-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-73-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-71-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-77-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-75-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-81-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-85-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-83-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-79-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-87-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-89-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-93-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-95-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-91-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-97-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-98-0x0000000002920000-0x0000000002AED000-memory.dmp

Filesize
1.8MB

Download
memory/1368-100-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/1368-101-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-102-0x0000000002920000-0x0000000002AED000-memory.dmp

Filesize
1.8MB

Download
memory/1368-103-0x0000000002920000-0x0000000002AED000-memory.dmp

Filesize
1.8MB

Download
memory/1368-107-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/1368-108-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1368-109-0x0000000002920000-0x0000000002AED000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads