e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea

General

Target

e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
Size

78KB
MD5

23a0df5308eb245c3cccd53f138c4801
SHA1

7f4c941c5862a1c08b43f0c507afb616041cbafe
SHA256

e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea
SHA512

c7875b59f0bf17509d32a7fc8b0aa620a03acb171b577212d435001f372e41decb6e6d5afa373df53a6f8d434bac0f0c1c68a39d0a71d564838f62758123f833
SSDEEP

1536:p5DpGlCVEVhTHXY+GoeJV7PdMZVBxCvclvs6wFB+wDUXoo:pz+PxHXJYrdeBxMclE6wFp8oo

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\TXP1atform.exe	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
File opened for modification	C:\Windows\SysWOW64\drivers\TXP1atform.exe	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe

Executes dropped EXE 1 IoCs

pid	Process
584	TXP1atform.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/992-55-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/files/0x000b0000000122ec-56.dat	upx
behavioral1/files/0x000b0000000122ec-57.dat	upx
behavioral1/files/0x000b0000000122ec-59.dat	upx
behavioral1/files/0x000b0000000122ec-61.dat	upx
behavioral1/memory/584-63-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/992-65-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/584-64-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
584	TXP1atform.exe
584	TXP1atform.exe
584	TXP1atform.exe
584	TXP1atform.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 584	992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe	28
PID 992 wrote to memory of 584	992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe	28
PID 992 wrote to memory of 584	992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe	28
PID 992 wrote to memory of 584	992	e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe	28

C:\Users\Admin\AppData\Local\Temp\e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe
"C:\Users\Admin\AppData\Local\Temp\e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\drivers\TXP1atform.exe
  C:\Windows\system32\drivers\TXP1atform.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\TXP1atform.exe

Filesize
78KB

MD5
23a0df5308eb245c3cccd53f138c4801

SHA1
7f4c941c5862a1c08b43f0c507afb616041cbafe

SHA256
e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea

SHA512
c7875b59f0bf17509d32a7fc8b0aa620a03acb171b577212d435001f372e41decb6e6d5afa373df53a6f8d434bac0f0c1c68a39d0a71d564838f62758123f833

Download Submit
C:\Windows\SysWOW64\drivers\TXP1atform.exe

Filesize
78KB

MD5
23a0df5308eb245c3cccd53f138c4801

SHA1
7f4c941c5862a1c08b43f0c507afb616041cbafe

SHA256
e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea

SHA512
c7875b59f0bf17509d32a7fc8b0aa620a03acb171b577212d435001f372e41decb6e6d5afa373df53a6f8d434bac0f0c1c68a39d0a71d564838f62758123f833

Download Submit
\Windows\SysWOW64\drivers\TXP1atform.exe

Filesize
78KB

MD5
23a0df5308eb245c3cccd53f138c4801

SHA1
7f4c941c5862a1c08b43f0c507afb616041cbafe

SHA256
e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea

SHA512
c7875b59f0bf17509d32a7fc8b0aa620a03acb171b577212d435001f372e41decb6e6d5afa373df53a6f8d434bac0f0c1c68a39d0a71d564838f62758123f833

Download Submit
\Windows\SysWOW64\drivers\TXP1atform.exe

Filesize
78KB

MD5
23a0df5308eb245c3cccd53f138c4801

SHA1
7f4c941c5862a1c08b43f0c507afb616041cbafe

SHA256
e855f790d61cbe53533597e45b1b468ec7400f75b2600cf5b51f1ca355470bea

SHA512
c7875b59f0bf17509d32a7fc8b0aa620a03acb171b577212d435001f372e41decb6e6d5afa373df53a6f8d434bac0f0c1c68a39d0a71d564838f62758123f833

Download Submit
memory/584-63-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/584-64-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/992-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/992-55-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/992-62-0x00000000001B0000-0x00000000001FD000-memory.dmp

Filesize
308KB

Download
memory/992-65-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing