e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072

Analysis

max time kernel
46s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe
Size

425KB
MD5

edaf88a4624d042afb334a9d4f3286f4
SHA1

a7a88d4b22ec8eb92cd9dbc72f24c3595b71268a
SHA256

e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072
SHA512

b831c4c46d3e862b830267208e44ccb8a8d504257767b53051f0b8c68734787d14abcb40a9ce9340487a7ca0440c457ecfe1c7035a776b79747f9a21e802be85
SSDEEP

12288:xJzSqCjDEICtZNZvtFhs7pl8zov+250aXd7GRi:xJOlEJtF/hs7pUsk

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/944-54-0x0000000000400000-0x00000000004E3000-memory.dmp	upx
behavioral1/memory/944-71-0x0000000000400000-0x00000000004E3000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1308	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 944 set thread context of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1904	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1904	AUDIODG.EXE
Token: 33	1904	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1904	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1308	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe
1308	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28
PID 944 wrote to memory of 1308	944	e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe	28

C:\Users\Admin\AppData\Local\Temp\e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe
"C:\Users\Admin\AppData\Local\Temp\e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe
  C:\Users\Admin\AppData\Local\Temp\e5273c45a39752e15db36c86ab256fc7bfce9298e533332afcd0c48647931072.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1308

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bm906.tmp

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
memory/944-54-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/944-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/944-73-0x0000000000690000-0x0000000000695000-memory.dmp

Filesize
20KB

Download
memory/944-72-0x00000000003B0000-0x00000000003F8000-memory.dmp

Filesize
288KB

Download
memory/944-71-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1308-68-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1308-65-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1308-62-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1308-59-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1308-57-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1308-74-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1308-56-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1308-76-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1308-77-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download