b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed

General

Target

b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
Size

297KB
MD5

3c2d01fdb542900c95b6f0e5fbe9b17d
SHA1

75c9717525e65afe9093cb1014573cd133972321
SHA256

b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed
SHA512

c97c26940f94116d7f7e3602ee803010f77639ab939417d39d3256780fd8b0d2ee35c0f338b40266af6ddafb6e3f98f90d95e435a1cd8c4f0a2255a3ee3c99fe
SSDEEP

6144:dt8+VUuzgQKH7kNRfwF02oVPm3dMWVtQu7zVmHkko:dt8+VULQaF02oYNXVtl9mHkn

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1628-56-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1628-60-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1628-62-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1628-68-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 set thread context of 0	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 1628 set thread context of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 1628	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	28
PID 1400 wrote to memory of 0	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 1400 wrote to memory of 0	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 1400 wrote to memory of 0	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 1400 wrote to memory of 0	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 1400 wrote to memory of 0	1400	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 1628 wrote to memory of 628	1628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	29
PID 628 wrote to memory of 1224	628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	10
PID 628 wrote to memory of 1224	628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	10
PID 628 wrote to memory of 1224	628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	10
PID 628 wrote to memory of 1224	628	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	10

C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
"C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
  "C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
    "C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:628

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-70-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/628-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/628-69-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/628-74-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1224-71-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1400-61-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1628-60-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1628-62-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1628-68-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1628-56-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1628-75-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing