d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2

General

Target

d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
Size

375KB
MD5

1171bdf2d44e19975c42922bc8a8cefa
SHA1

bb1d9ef7c91e21e38597336a8b68dec004825f05
SHA256

d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2
SHA512

1221ac9723433b7bc1ce7350bf6fed94708922365905c75270dd0e22eb2543d07d6babd70e5f2cf18382cc1b270a0cb10072982dd2baedf3ee1d7dd4c2bd9d88
SSDEEP

6144:O048oQKZED/s/L/hb7/w8D29oerTm79Htija8zQKecywVSL735lweHG28dc769/l:NozZus/LJc8D29oerTmBH0ja8zFVywv5

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4744-135-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4744-137-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4744-138-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4744-145-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 set thread context of 0	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 4744 set thread context of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 4744	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	82
PID 4800 wrote to memory of 0	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 4800 wrote to memory of 0	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 4800 wrote to memory of 0	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 4800 wrote to memory of 0	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 4800 wrote to memory of 0	4800	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
PID 4744 wrote to memory of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83
PID 4744 wrote to memory of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83
PID 4744 wrote to memory of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83
PID 4744 wrote to memory of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83
PID 4744 wrote to memory of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83
PID 4744 wrote to memory of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83
PID 4744 wrote to memory of 4848	4744	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	83
PID 4848 wrote to memory of 2212	4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	40
PID 4848 wrote to memory of 2212	4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	40
PID 4848 wrote to memory of 2212	4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	40
PID 4848 wrote to memory of 2212	4848	d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2212
- C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
  "C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
    "C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe
      "C:\Users\Admin\AppData\Local\Temp\d53263b2614c9e565a20cae5c306b2eeae94b2f716250743e29e36272fa0b6e2.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-140-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2212-147-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4744-135-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4744-137-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4744-138-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4744-145-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4848-143-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4848-146-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4848-148-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing