e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1

General

Target

e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe
Size

79KB
MD5

a4459b1cadf9a673e5b5de0889cad647
SHA1

ad8dff9e6071217503825425d7afab14c459c69d
SHA256

e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1
SHA512

754f0b781c3f0a6062a2d66ec73c7c1ee505d57f1e195d7a0799658f9ef69d1ddb64156c8f34a9f54ea8ca1f3b8ee202708bb31da876904291e8574190adf398
SSDEEP

1536:X68F1XnstmbwbYA+6Q0XfXVsEg0WWU1sb1tic7cJ0XRR6tj2qkSZZZ3gb0ibzMOB:XR3stcAXQ0XNK0WWU1sJtg0Xr6tjYUCr

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1472-54-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1472-64-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1472 set thread context of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe
1588	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1472 wrote to memory of 1588	1472	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	26
PID 1588 wrote to memory of 1412	1588	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	7
PID 1588 wrote to memory of 1412	1588	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	7
PID 1588 wrote to memory of 1412	1588	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	7
PID 1588 wrote to memory of 1412	1588	e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe
  "C:\Users\Admin\AppData\Local\Temp\e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe
    C:\Users\Admin\AppData\Local\Temp\e80ebfb8cf44a027f853583181244ad4bac0c77f1934d92620b14b4fd5e53ce1.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-67-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1472-54-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1472-64-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1588-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1588-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1588-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1588-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1588-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1588-66-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1588-70-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1588-71-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing