86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9

General

Target

86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
Size

1.7MB
MD5

7a7dc8e9c135984d12a179dcea4b6882
SHA1

fa33b00513764a13e80cb84dd409e8b4c21323b6
SHA256

86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9
SHA512

544b328e4404d39c902657500ef290776e81b6964db4d3b96a696e67415dd3309a44a51df93153b5b2ee777bcae0547ddb25aed0c7e8e43acdd4df125730a648
SSDEEP

49152:KGCZVJhdKsafhKtGqKIBwiCd99q5sTU83lMq:KGoVQsafUGimU5sTU/q

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/428-139-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/428-144-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/428-147-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/428-151-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/428-153-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/428-155-0x0000000000400000-0x00000000006B3000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 checkip.dyndns.org

flow	ioc
42	checkip.dyndns.org

Suspicious use of SetThreadContext 4 IoCs

Processes:

86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe

description	pid	process	target process
PID 344 set thread context of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 3468 set thread context of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 set thread context of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 set thread context of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

svchost.exe

pid process

428 svchost.exe
428 svchost.exe
428 svchost.exe
428 svchost.exe

pid	process
428	svchost.exe
428	svchost.exe
428	svchost.exe
428	svchost.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe

description	pid	process	target process
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 344 wrote to memory of 3468	344	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
PID 3468 wrote to memory of 3680	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3680	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3680	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 428	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 3868	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 5044	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 5044	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 5044	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe
PID 3468 wrote to memory of 1156	3468	86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
"C:\Users\Admin\AppData\Local\Temp\86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:344

C:\Users\Admin\AppData\Local\Temp\86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
C:\Users\Admin\AppData\Local\Temp\86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
3⤵
PID:3680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe (null)
3⤵
PID:3868

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe ext "C:\Users\Admin\AppData\Local\Temp\86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe"
3⤵
PID:5044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe ext "C:\Users\Admin\AppData\Local\Temp\86d2237fa0d97bcedb520ce34ed8735deea36fbfdf1f5f8ded884e907b70eff9.exe"
3⤵
PID:1156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-139-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/428-151-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/428-147-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/428-153-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/428-144-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/428-155-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/428-138-0x0000000000000000-mapping.dmp

Download
memory/1156-145-0x0000000000000000-mapping.dmp

Download
memory/1156-156-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1156-154-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1156-148-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3468-132-0x0000000000000000-mapping.dmp

Download
memory/3468-136-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/3468-135-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/3468-134-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/3468-133-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/3468-150-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/3680-137-0x0000000000000000-mapping.dmp

Download
memory/3868-152-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3868-146-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3868-141-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3868-140-0x0000000000000000-mapping.dmp

Download
memory/5044-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads