d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2

General

Target

d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
Size

375KB
MD5

1171bdf2d44e19975c42922bc8a8cefa
SHA1

bb1d9ef7c91e21e38597336a8b68dec004825f05
SHA256

d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2
SHA512

1221ac9723433b7bc1ce7350bf6fed94708922365905c75270dd0e22eb2543d07d6babd70e5f2cf18382cc1b270a0cb10072982dd2baedf3ee1d7dd4c2bd9d88
SSDEEP

6144:O048oQKZED/s/L/hb7/w8D29oerTm79Htija8zQKecywVSL735lweHG28dc769/l:NozZus/LJc8D29oerTmBH0ja8zFVywv5

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1880-56-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1880-59-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1880-60-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1880-63-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1880-67-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 set thread context of 0	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 1880 set thread context of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
940	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 1880	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	27
PID 1480 wrote to memory of 0	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 1480 wrote to memory of 0	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 1480 wrote to memory of 0	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 1480 wrote to memory of 0	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 1480 wrote to memory of 0	1480	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 1880 wrote to memory of 940	1880	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	28
PID 940 wrote to memory of 1416	940	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	15
PID 940 wrote to memory of 1416	940	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	15
PID 940 wrote to memory of 1416	940	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	15
PID 940 wrote to memory of 1416	940	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1416
- C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
  "C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
    "C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
      "C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-64-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/940-69-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/940-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/940-70-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/940-74-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1416-71-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1880-59-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1880-60-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1880-63-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1880-67-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1880-56-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing