951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d

General

Target

951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe
Size

240KB
MD5

0069d4a9672c51106b18dc75e3f9d69d
SHA1

e0fa7a0805473c9d0102ce5dcb469c6236f34956
SHA256

951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d
SHA512

185116e28a705e36055556d3591cc41c649dc404ca687d5de2a2f966669802767cbe3f342c7727d437bb3d8c271a510d7cd91d4f51abc5e5929408fe0552d227
SSDEEP

6144:xBLR3G8udJQGVplKOoOkY68kq18MzXQvon2djN1:xVRqQCiTYx1BXQQnEh1

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/524-58-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/524-61-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/524-63-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/524-69-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 524 set thread context of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1500	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe
1500	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe
524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 1228 wrote to memory of 524	1228	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	28
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 524 wrote to memory of 1500	524	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	29
PID 1500 wrote to memory of 1256	1500	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	17
PID 1500 wrote to memory of 1256	1500	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	17
PID 1500 wrote to memory of 1256	1500	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	17
PID 1500 wrote to memory of 1256	1500	951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe	17

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe
  "C:\Users\Admin\AppData\Local\Temp\951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe
    "C:\Users\Admin\AppData\Local\Temp\951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:524
  - - C:\Users\Admin\AppData\Local\Temp\951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe
      "C:\Users\Admin\AppData\Local\Temp\951a79a1ca44849a4b9c5731c38578aa0475cd6bace03cfe51c3c92e8f9d4f1d.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-63-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/524-69-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/524-58-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/524-61-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1228-62-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1228-57-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1228-54-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1256-73-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1500-70-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1500-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1500-71-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/1500-72-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1500-76-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing