b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed

General

Target

b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
Size

297KB
MD5

3c2d01fdb542900c95b6f0e5fbe9b17d
SHA1

75c9717525e65afe9093cb1014573cd133972321
SHA256

b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed
SHA512

c97c26940f94116d7f7e3602ee803010f77639ab939417d39d3256780fd8b0d2ee35c0f338b40266af6ddafb6e3f98f90d95e435a1cd8c4f0a2255a3ee3c99fe
SSDEEP

6144:dt8+VUuzgQKH7kNRfwF02oVPm3dMWVtQu7zVmHkko:dt8+VULQaF02oYNXVtl9mHkn

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-136-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4940-138-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4940-140-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4940-144-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4940-148-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 set thread context of 0	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 4940 set thread context of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 4940	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	82
PID 4540 wrote to memory of 0	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 4540 wrote to memory of 0	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 4540 wrote to memory of 0	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 4540 wrote to memory of 0	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 4540 wrote to memory of 0	4540	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
PID 4940 wrote to memory of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83
PID 4940 wrote to memory of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83
PID 4940 wrote to memory of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83
PID 4940 wrote to memory of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83
PID 4940 wrote to memory of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83
PID 4940 wrote to memory of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83
PID 4940 wrote to memory of 4816	4940	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	83
PID 4816 wrote to memory of 2416	4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	43
PID 4816 wrote to memory of 2416	4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	43
PID 4816 wrote to memory of 2416	4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	43
PID 4816 wrote to memory of 2416	4816	b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2416
- C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
  "C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
    "C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
      "C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-139-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2416-150-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4540-141-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4540-132-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4816-146-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4816-149-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4816-151-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4940-136-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-138-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-140-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-144-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-148-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing