6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe
Size

12.6MB
MD5

8b36d3e66f420a38a23f2a347e43e6eb
SHA1

4fb44a0509c033474bacdcd1ff2aba8cc7379ba5
SHA256

6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128
SHA512

285c4e0730cc8f09219f2dbe138f547df3b10e1f3da479fbed9843b7a5b1d49e9f3aabb053606422cfe209169c455a86c870acf4cb7377ba2c3423678b0942eb
SSDEEP

49152:9+TPTHAcLMEFnv6fKis15UgLexWa78k2oUcInbICRh8:9IPTA8FnVzNSIoUpnbIw

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2276-137-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/2276-139-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/2276-142-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/2276-145-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/2276-151-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/2276-155-0x0000000000400000-0x00000000006B3000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	checkip.dyndns.org

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2948 set thread context of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 set thread context of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 set thread context of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	svchost.exe
2276	svchost.exe
2276	svchost.exe
2276	svchost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2148 wrote to memory of 2948	2148	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	80
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 2276	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	81
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 692	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	83
PID 2948 wrote to memory of 2652	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	84
PID 2948 wrote to memory of 2652	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	84
PID 2948 wrote to memory of 2652	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	84
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85
PID 2948 wrote to memory of 4824	2948	6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe	85

C:\Users\Admin\AppData\Local\Temp\6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe
"C:\Users\Admin\AppData\Local\Temp\6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe
  "C:\Users\Admin\AppData\Local\Temp\6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2276
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe (null)
    3⤵
    PID:692
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe ext "C:\Users\Admin\AppData\Local\Temp\6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe"
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe ext "C:\Users\Admin\AppData\Local\Temp\6fe2d0d5b5fa288a5b4be0e15f2736bfb3d2fdc12536d5f6576fd84fcbf56128.exe"
    3⤵
    PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-156-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/692-153-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/692-144-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/692-140-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/2276-137-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/2276-139-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/2276-142-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/2276-155-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/2276-145-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/2276-151-0x0000000000400000-0x00000000006B3000-memory.dmp

Filesize
2.7MB

Download
memory/2948-148-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2948-150-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2948-134-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2948-135-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2948-133-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4824-152-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4824-147-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4824-154-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download