e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9

General

Target

e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
Size

264KB
MD5

3e174e5a2b6f3e11aa41fdba4592ff80
SHA1

b28263e523b63f8479cf3e5c16805637277bb1d6
SHA256

e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9
SHA512

fc8a62d50d186918edcbaed7d903ac35250cbca579cf832284ea5b8e0934077fa85d3ef3a32b48d038ad94178c971d44db08c39e738a83806d445cb7e8e5a790
SSDEEP

3072:l7PB6uNUX3G8mVwQUCfFRiJ2/zXJmk+Q4iAISE15O2fqmSiaxy8XJpHDsoVUI2dJ:FpZW4aCfHEwXJEQ4iAwBgn2djN01ard

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1716-136-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1716-140-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1716-138-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1716-146-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 216 set thread context of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 1716 set thread context of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 216 wrote to memory of 1716	216	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	83
PID 1716 wrote to memory of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84
PID 1716 wrote to memory of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84
PID 1716 wrote to memory of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84
PID 1716 wrote to memory of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84
PID 1716 wrote to memory of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84
PID 1716 wrote to memory of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84
PID 1716 wrote to memory of 428	1716	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	84
PID 428 wrote to memory of 2584	428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	39
PID 428 wrote to memory of 2584	428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	39
PID 428 wrote to memory of 2584	428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	39
PID 428 wrote to memory of 2584	428	e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe	39

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2584
- C:\Users\Admin\AppData\Local\Temp\e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
  "C:\Users\Admin\AppData\Local\Temp\e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Users\Admin\AppData\Local\Temp\e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
    "C:\Users\Admin\AppData\Local\Temp\e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe
      "C:\Users\Admin\AppData\Local\Temp\e1be634a37bc6e55e582c7797a8a2e9bd536b700c725282ea474373304da11b9.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-132-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/216-139-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/428-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/428-147-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/428-149-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1716-136-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1716-140-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1716-138-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1716-146-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2584-148-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing