b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43

General

Target

b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
Size

101KB
MD5

2aadcb5c1f51786e7afb28e7b138c5b5
SHA1

008efdcee16310f315dd475dc3c7978785bc6c4d
SHA256

b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43
SHA512

7d167a602683756312c0737311fffa51ef833ab6da9a8e1ead91eda8a4d4dbdbfe94565bba0bde15c65778e0fcc7a6e7df2e50d53246d339ea1bde3e74f188be
SSDEEP

3072:cpd0RYoMFMiCV/NPn/ggjd2kV/YsgdL/DB1v:cp+moM2iS/Nv4xigxB1v

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4396-132-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4396-133-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4396-140-0x0000000000400000-0x0000000000448000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4396 set thread context of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 2412 set thread context of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 4396 wrote to memory of 2412	4396	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	85
PID 2412 wrote to memory of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88
PID 2412 wrote to memory of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88
PID 2412 wrote to memory of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88
PID 2412 wrote to memory of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88
PID 2412 wrote to memory of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88
PID 2412 wrote to memory of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88
PID 2412 wrote to memory of 4348	2412	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	88
PID 4348 wrote to memory of 964	4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	55
PID 4348 wrote to memory of 964	4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	55
PID 4348 wrote to memory of 964	4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	55
PID 4348 wrote to memory of 964	4348	b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:964
- C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
  "C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
    C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe
      "C:\Users\Admin\AppData\Local\Temp\b548d8d50839a3f8228b223314c51a5024680e86c8f13a4b1468db8a2efa9e43.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-150-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2412-142-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2412-137-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2412-146-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4348-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-147-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-148-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-149-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4348-151-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4396-132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4396-140-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4396-133-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing