8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db

General

Target

8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
Size

1.3MB
MD5

43815602fbfdf97192d887101980488a
SHA1

8cfbafc496a06a0df867650e453902ad88866356
SHA256

8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db
SHA512

e2047a180d79f31a6ddb41340c6aebff6e9d95add458a74569eee1dcf080d8cb96d3bb9934353247b260cdbdb50b1a9de6f3eab766b9bc28675d37676f53bcbf
SSDEEP

24576:C11IAFWZlV3VHhWWyc/6AjUsNtef75MX9d7mrFYu3vW8N4J+Mam/Es:C05Z/+86AjLMtMX9pvueQ/Mamj

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4184-132-0x0000000000400000-0x000000000063B000-memory.dmp	upx
behavioral2/memory/4112-136-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4112-139-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4112-138-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4112-145-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4184-150-0x0000000000400000-0x000000000063B000-memory.dmp	upx
behavioral2/memory/4112-149-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Greenstone.bmp	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
File created	C:\Windows\SysWOW64\ataLiveUpdate.dll	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4184 set thread context of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 set thread context of 0	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
PID 4112 set thread context of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 4112	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	80
PID 4184 wrote to memory of 0	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
PID 4184 wrote to memory of 0	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
PID 4184 wrote to memory of 0	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
PID 4184 wrote to memory of 0	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
PID 4184 wrote to memory of 0	4184	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
PID 4112 wrote to memory of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81
PID 4112 wrote to memory of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81
PID 4112 wrote to memory of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81
PID 4112 wrote to memory of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81
PID 4112 wrote to memory of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81
PID 4112 wrote to memory of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81
PID 4112 wrote to memory of 4692	4112	8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe	81

C:\Users\Admin\AppData\Local\Temp\8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
"C:\Users\Admin\AppData\Local\Temp\8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
  "C:\Users\Admin\AppData\Local\Temp\8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Users\Admin\AppData\Local\Temp\8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe
    "C:\Users\Admin\AppData\Local\Temp\8e9aad4b7988d4d0e6b5f25879aa32016ca379e21177a3d3e8dfd455f16759db.exe"
    3⤵
    PID:4692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-141-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4112-136-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4112-139-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4112-138-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4112-149-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4112-145-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4184-150-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/4184-132-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/4692-148-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4692-147-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4692-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4692-151-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing