e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c

General

Target

e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
Size

171KB
MD5

803fdad60a108f80a0e664405cc2e176
SHA1

1b1f296ac0d1c9d2a9ceba06dc6b059c6a86dcef
SHA256

e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c
SHA512

feae207b9f3d7d261d67cb5baea813a65ebcd6204ba0896eb2ecfb2de6a3f585b7223a562541634c7d430d0d5cc8e962a97e8768c8f106d7e695953c911328a5
SSDEEP

3072:R9pxBqTJwFaaALjoLPNVw1ue/ViucaA+5q52We4iHV5gZBMAculva/vA962Pout:HPBqCcasYNTBQt0oF44/vN+oS

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4924-132-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/4924-139-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/2660-147-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/2660-149-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4924 set thread context of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 2660 set thread context of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3428	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3428	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3428	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
3428	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 4924 wrote to memory of 3704	4924	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	82
PID 3704 wrote to memory of 2660	3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	83
PID 3704 wrote to memory of 2660	3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	83
PID 3704 wrote to memory of 2660	3704	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	83
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84
PID 2660 wrote to memory of 3428	2660	e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe	84

C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
"C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
  "C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
    "C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe
      "C:\Users\Admin\AppData\Local\Temp\e139bedff7272d29a58b6058148485a6a051e78e8a7c27af9b4207445b55972c.exe"
      4⤵
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-149-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2660-147-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3428-150-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3704-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3704-140-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3704-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3704-136-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3704-134-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4924-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4924-132-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing