a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81

General

Target

a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
Size

273KB
MD5

25067ca6c48df5cafc8b2bd05d91420c
SHA1

884091925b17ce49adda17ff88f64a9765a319df
SHA256

a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81
SHA512

c4c2a6e604de419a9819a07e36d6325f3554cc325194b1ee8ef6f85a6ab9643c1f3682dd02ccfd283e63236f38bac3c3996ec137f5dc444bf263daa767b80ca7
SSDEEP

6144:wITeVe9kb/cZKALVJMd/9Sfs+u9jXqvemG8lM1YUD1YUt:wITeTjcZraFS10+RGcMKUDKUt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3540-136-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3540-138-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3540-140-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3540-144-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3540-145-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3540-149-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4384 set thread context of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 set thread context of 0	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
PID 3540 set thread context of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 3540	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	78
PID 4384 wrote to memory of 0	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
PID 4384 wrote to memory of 0	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
PID 4384 wrote to memory of 0	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
PID 4384 wrote to memory of 0	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
PID 4384 wrote to memory of 0	4384	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
PID 3540 wrote to memory of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79
PID 3540 wrote to memory of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79
PID 3540 wrote to memory of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79
PID 3540 wrote to memory of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79
PID 3540 wrote to memory of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79
PID 3540 wrote to memory of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79
PID 3540 wrote to memory of 900	3540	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	79
PID 900 wrote to memory of 2424	900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	45
PID 900 wrote to memory of 2424	900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	45
PID 900 wrote to memory of 2424	900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	45
PID 900 wrote to memory of 2424	900	a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe	45

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2424
- C:\Users\Admin\AppData\Local\Temp\a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
  "C:\Users\Admin\AppData\Local\Temp\a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Local\Temp\a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
    "C:\Users\Admin\AppData\Local\Temp\a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe
      "C:\Users\Admin\AppData\Local\Temp\a9ebda385808d3907a3923d6001b0e960b5fc5a8a44e06a040bd8473138f5d81.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-139-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/900-153-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/900-151-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/900-150-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/900-147-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2424-152-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3540-140-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3540-145-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3540-144-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3540-149-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3540-138-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3540-136-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4384-142-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4384-134-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download

Analysis

Sharing