9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158

General

Target

9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe
Size

883KB
MD5

ec500463ec1b18df5e12739537d42a1f
SHA1

ad3453e877940f826152e00b9338911b7c1c9399
SHA256

9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158
SHA512

cf3c378e502ed0d414fa070b94f7ce1f9ba3aac14e50bd20fcc9f1ccb09fb6570baa228d25932c386ca714881c96c1c25786d1bcb35db55d8ad63179bdc6df9e
SSDEEP

3072:eZTTvrxBhuEWq9xatviq+iLSknHhUcBZTY/Pviq+iLSknHhUcBZTY/6viq+iLSkm:s7CBNF7CBNC7CBN2aDALKbLPZ7+7CB1+

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1640-56-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1640-60-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1640-61-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1640-67-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1396 set thread context of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1640 set thread context of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe
1164	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe
1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1396 wrote to memory of 1640	1396	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	27
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1640 wrote to memory of 1164	1640	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	28
PID 1164 wrote to memory of 1304	1164	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	14
PID 1164 wrote to memory of 1304	1164	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	14
PID 1164 wrote to memory of 1304	1164	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	14
PID 1164 wrote to memory of 1304	1164	9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1304
- C:\Users\Admin\AppData\Local\Temp\9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe
  "C:\Users\Admin\AppData\Local\Temp\9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe
    "C:\Users\Admin\AppData\Local\Temp\9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe
      "C:\Users\Admin\AppData\Local\Temp\9069cfc9c08a7b7dec90950de7bc51fbb9928275d28ce9f3a389ff358222b158.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1164-68-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1164-69-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1164-73-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1304-70-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1396-59-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/1640-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1640-60-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1640-61-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1640-67-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing