a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b

General

Target

a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe
Size

1.1MB
MD5

ebf006c9a11b62bbf1cef4ac3dc2c976
SHA1

ce11fb387012568f9a4efd883f078b974319db6c
SHA256

a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b
SHA512

96ba725c06aae914897bc1095232cc8bd93cf34fb316b5cbe53ae719cc2681f0a2f3cced68ca36b44c57fb79dbdaca0909b998efa683cce75ddf54431571fd05
SSDEEP

24576:fSCaKah9dyUNsN3wZDilOuj0sMEjfcWi3czGlFI+9ncozbNc:1aKvUmNggl7wvZ3SwFl9n5zbNc

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/800-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-105-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-103-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-101-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/800-106-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe

description ioc process

File opened for modification C:\Windows\ a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe

description	ioc	process
File opened for modification	C:\Windows\	a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe

description	pid	process
Token: SeDebugPrivilege	800	a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe
Token: SeDebugPrivilege	800	a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe

pid	process
800	a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe
800	a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe
800	a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe

C:\Users\Admin\AppData\Local\Temp\a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe
"C:\Users\Admin\AppData\Local\Temp\a759de3d2144eba23ef2a14cf47bdbc48aeda148af3c4f4d0f448fddf880ab8b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/800-55-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/800-57-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/800-56-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/800-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-61-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/800-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-105-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-103-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-101-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-106-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/800-107-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads