fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc

General

Target

fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
Size

332KB
MD5

51470769a1510b21057797ae7a3065bc
SHA1

3207810d8f08b8a03658d228b9fd57987ce12620
SHA256

fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc
SHA512

4be759ca2666dd6a9f4569b347539db07b70dbf19b84eff12d342d0bbd48dee271962c5dd494e91901b9d8cb34c7c3e4cb6a6ed8d25c0f8249178770f57089dd
SSDEEP

6144:tZyte8NZTHr4921y4xNqqgwa77jQExKxz5o0IWrVMKX:t0te8NZTHrnxbk7gFrVt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3612-136-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3612-139-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3612-140-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3612-144-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3612-148-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 set thread context of 0	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 3612 set thread context of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 3612	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	80
PID 1092 wrote to memory of 0	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1092 wrote to memory of 0	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1092 wrote to memory of 0	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1092 wrote to memory of 0	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 1092 wrote to memory of 0	1092	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
PID 3612 wrote to memory of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81
PID 3612 wrote to memory of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81
PID 3612 wrote to memory of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81
PID 3612 wrote to memory of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81
PID 3612 wrote to memory of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81
PID 3612 wrote to memory of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81
PID 3612 wrote to memory of 4740	3612	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	81
PID 4740 wrote to memory of 2228	4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	41
PID 4740 wrote to memory of 2228	4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	41
PID 4740 wrote to memory of 2228	4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	41
PID 4740 wrote to memory of 2228	4740	fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe	41

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2228
- C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
  "C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
    "C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe
      "C:\Users\Admin\AppData\Local\Temp\fb7328bfea9cc77d2a78b0853adf855f0d6741be7bf616f747d06863b8c147cc.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-138-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1092-143-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1092-132-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2228-150-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3612-136-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3612-139-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3612-140-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3612-144-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3612-148-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4740-146-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4740-149-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4740-151-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing