927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28

General

Target

927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe
Size

8.6MB
MD5

e2cfad6b5e1b6a2ce81485152f38cd57
SHA1

e99d57e507705732ed5f1ffd3da4e0676af4a49d
SHA256

927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28
SHA512

2d523faf178654007776d3ddf0ce1c123e8f9b88ddda18f0176dfc10b7880ee60289ed481ae9c038bad0286d0c08c628b773aa8fab1fce22ce6694a9299b7efc
SSDEEP

49152:3s70hVTX6oiwRDAL8FOXff9tx2RK3J1MHq:3s70TXFRDAL8utxdM

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1164-72-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1164-74-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1164-76-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1164-78-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1164-83-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1164-84-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral1/memory/1164-85-0x0000000000400000-0x00000000006B3000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 956 set thread context of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	svchost.exe
1164	svchost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 1368 wrote to memory of 956	1368	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	28
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1164	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	29
PID 956 wrote to memory of 1112	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	31
PID 956 wrote to memory of 1112	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	31
PID 956 wrote to memory of 1112	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	31
PID 956 wrote to memory of 1112	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	31
PID 956 wrote to memory of 1112	956	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	31

C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe
"C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe
  "C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1164
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe (null)
    3⤵
    PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-75-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-55-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-56-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-58-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-60-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-62-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-64-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-66-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/956-70-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/1112-79-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/1112-81-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/1164-71-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1164-74-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1164-76-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1164-72-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1164-78-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1164-83-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1164-84-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1164-85-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/1368-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing