927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28

Analysis

max time kernel
148s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe
Size

8.6MB
MD5

e2cfad6b5e1b6a2ce81485152f38cd57
SHA1

e99d57e507705732ed5f1ffd3da4e0676af4a49d
SHA256

927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28
SHA512

2d523faf178654007776d3ddf0ce1c123e8f9b88ddda18f0176dfc10b7880ee60289ed481ae9c038bad0286d0c08c628b773aa8fab1fce22ce6694a9299b7efc
SSDEEP

49152:3s70hVTX6oiwRDAL8FOXff9tx2RK3J1MHq:3s70TXFRDAL8utxdM

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4548-139-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/4548-149-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/4548-151-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/4548-152-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/4548-154-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/4548-156-0x0000000000400000-0x00000000006B3000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	checkip.dyndns.org

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4300 set thread context of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 2572 set thread context of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 set thread context of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 set thread context of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 4300 wrote to memory of 2572	4300	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	85
PID 2572 wrote to memory of 1456	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	86
PID 2572 wrote to memory of 1456	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	86
PID 2572 wrote to memory of 1456	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	86
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 4548	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	87
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 3496	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	88
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90
PID 2572 wrote to memory of 4952	2572	927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe	90

C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe
"C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe
  "C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4548
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe (null)
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe ext "C:\Users\Admin\AppData\Local\Temp\927cc7fb9726fefa6f2be027e9d00ebedb7176af263748ac27cff6fc3bbefc28.exe"
    3⤵
    PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-147-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2572-133-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2572-134-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2572-135-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2572-136-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/3496-155-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/3496-153-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/3496-141-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/3496-148-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/4548-149-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/4548-151-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/4548-152-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/4548-139-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/4548-154-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/4548-156-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/4952-146-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4952-144-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4952-150-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download