fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc

General

Target

fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
Size

332KB
MD5

51470769a1510b21057797ae7a3065bc
SHA1

3207810d8f08b8a03658d228b9fd57987ce12620
SHA256

fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc
SHA512

4be759ca2666dd6a9f4569b347539db07b70dbf19b84eff12d342d0bbd48dee271962c5dd494e91901b9d8cb34c7c3e4cb6a6ed8d25c0f8249178770f57089dd
SSDEEP

6144:tZyte8NZTHr4921y4xNqqgwa77jQExKxz5o0IWrVMKX:t0te8NZTHrnxbk7gFrVt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1348-56-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1348-60-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1348-62-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1348-68-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 set thread context of 0	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1348 set thread context of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
572	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
572	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 1348	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	28
PID 1776 wrote to memory of 0	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1776 wrote to memory of 0	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1776 wrote to memory of 0	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1776 wrote to memory of 0	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1776 wrote to memory of 0	1776	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 1348 wrote to memory of 572	1348	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	29
PID 572 wrote to memory of 1264	572	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	19
PID 572 wrote to memory of 1264	572	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	19
PID 572 wrote to memory of 1264	572	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	19
PID 572 wrote to memory of 1264	572	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	19

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264
- C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
  "C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
    "C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
      "C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/572-69-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/572-70-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/572-74-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1264-71-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1348-56-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1348-60-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1348-62-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1348-68-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1776-61-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing