b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43

General

Target

b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
Size

101KB
MD5

2aadcb5c1f51786e7afb28e7b138c5b5
SHA1

008efdcee16310f315dd475dc3c7978785bc6c4d
SHA256

b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43
SHA512

7d167a602683756312c0737311fffa51ef833ab6da9a8e1ead91eda8a4d4dbdbfe94565bba0bde15c65778e0fcc7a6e7df2e50d53246d339ea1bde3e74f188be
SSDEEP

3072:cpd0RYoMFMiCV/NPn/ggjd2kV/YsgdL/DB1v:cp+moM2iS/Nv4xigxB1v

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-59-0x0000000000400000-0x0000000000448000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1048 set thread context of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
844	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
844	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1724 wrote to memory of 1048	1724	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	27
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 1048 wrote to memory of 844	1048	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	28
PID 844 wrote to memory of 1348	844	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	15
PID 844 wrote to memory of 1348	844	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	15
PID 844 wrote to memory of 1348	844	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	15
PID 844 wrote to memory of 1348	844	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1348
- C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
  "C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
    C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
      "C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-71-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/844-77-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/844-76-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/844-72-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/844-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/844-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/844-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/844-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/844-68-0x0000000000407C89-mapping.dmp

Download
memory/1048-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1048-70-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1048-56-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1048-57-0x00000000004010B0-mapping.dmp

Download
memory/1348-73-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1724-59-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing