f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41

General

Target

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
Size

53KB
MD5

44e6841dbe421e7fffd7c65ed0c34ac4
SHA1

f4c7c4cb1eb50b49f4945fbc1a0910ae37a4f3d6
SHA256

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41
SHA512

d91ca24443bf64d2cceea4792d93bf9127eefb5e212d5d2147edfc60a5d8589ddf78667d5b44a0619738075e89bd6daa50b5c37ce782e5d267bda3656b8de4e7
SSDEEP

1536:9L2RmQVYNsWt5p/XJerUMdwgUHBKOeTygr:RFLp/JolQwOez

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1184-54-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

pid process

1184 f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

pid	process
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description pid process

Token: SeDebugPrivilege 1184 f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description	pid	process
Token: SeDebugPrivilege	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description	pid	process	target process
PID 1184 wrote to memory of 368	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	wininit.exe
PID 1184 wrote to memory of 368	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	wininit.exe
PID 1184 wrote to memory of 368	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	wininit.exe
PID 1184 wrote to memory of 368	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	wininit.exe
PID 1184 wrote to memory of 368	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	wininit.exe
PID 1184 wrote to memory of 368	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	wininit.exe
PID 1184 wrote to memory of 368	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	wininit.exe
PID 1184 wrote to memory of 380	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	csrss.exe
PID 1184 wrote to memory of 380	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	csrss.exe
PID 1184 wrote to memory of 380	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	csrss.exe
PID 1184 wrote to memory of 380	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	csrss.exe
PID 1184 wrote to memory of 380	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	csrss.exe
PID 1184 wrote to memory of 380	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	csrss.exe
PID 1184 wrote to memory of 380	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	csrss.exe
PID 1184 wrote to memory of 416	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 1184 wrote to memory of 416	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 1184 wrote to memory of 416	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 1184 wrote to memory of 416	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 1184 wrote to memory of 416	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 1184 wrote to memory of 416	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 1184 wrote to memory of 416	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 1184 wrote to memory of 460	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	services.exe
PID 1184 wrote to memory of 460	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	services.exe
PID 1184 wrote to memory of 460	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	services.exe
PID 1184 wrote to memory of 460	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	services.exe
PID 1184 wrote to memory of 460	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	services.exe
PID 1184 wrote to memory of 460	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	services.exe
PID 1184 wrote to memory of 460	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	services.exe
PID 1184 wrote to memory of 476	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 1184 wrote to memory of 476	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 1184 wrote to memory of 476	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 1184 wrote to memory of 476	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 1184 wrote to memory of 476	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 1184 wrote to memory of 476	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 1184 wrote to memory of 476	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 1184 wrote to memory of 484	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsm.exe
PID 1184 wrote to memory of 484	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsm.exe
PID 1184 wrote to memory of 484	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsm.exe
PID 1184 wrote to memory of 484	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsm.exe
PID 1184 wrote to memory of 484	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsm.exe
PID 1184 wrote to memory of 484	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsm.exe
PID 1184 wrote to memory of 484	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsm.exe
PID 1184 wrote to memory of 584	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 584	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 584	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 584	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 584	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 584	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 584	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 660	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 660	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 660	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 660	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 660	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 660	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 660	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 744	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 744	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 744	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 744	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 744	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 744	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 744	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 1184 wrote to memory of 796	1184	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1060

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:536

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1116

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:584

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1988

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
"C:\Users\Admin\AppData\Local\Temp\f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads