aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3

General

Target

aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
Size

557KB
MD5

2dc2ec61c9cc6b6e55880952ed063521
SHA1

915ff1c43c20538e51b09fc775fdc5b908091837
SHA256

aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3
SHA512

98f3f16f23c76e42a4247c487e7c6d21f73f158da6928c3a51354c4f8086d05962e55c0a5a6d0de3e079378bb298fc6f010c61b7d127519bab67c5663a0880fc
SSDEEP

6144:KxCIqMUcsrgENAnR14Uyf93PypZ1bxb0Bvc4DWV/b5eR:fIrUcsrgENAnjc90ZbAvJ0MR

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-56-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/1176-57-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1668-60-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/1176-62-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1176-61-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1176-68-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1176 set thread context of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1668 wrote to memory of 1176	1668	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	28
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29
PID 1176 wrote to memory of 1244	1176	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	29

C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
"C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
  "C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
    "C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe"
    3⤵
    PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-57-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1176-62-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1176-61-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1176-68-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1244-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1244-69-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1244-70-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1244-71-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1668-56-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1668-60-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download

Analysis

Sharing