b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27

General

Target

b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe
Size

145KB
MD5

90f87ec86d0b5514075b5aacc83c0dc0
SHA1

3ea8f1359eb452891e485ea9f4304e5866f12159
SHA256

b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27
SHA512

796c987b9b1e4ae69ed052894b693327a8551510b8e69755808f936f5268d8ac8904b7ed4922372783b49b802782a2724ac78708fd955b7cd76a89753b02699e
SSDEEP

3072:bnTeNHxCCUSJhRg/PvYdiS5dIU2Xzz7gEFHqd0lyCT3GjQP:bTawCUSzS/bS5mblHqClye3eQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/736-54-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/736-64-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/736-72-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 736 set thread context of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe
1952	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 736 wrote to memory of 1952	736	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	27
PID 1952 wrote to memory of 1416	1952	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	15
PID 1952 wrote to memory of 1416	1952	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	15
PID 1952 wrote to memory of 1416	1952	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	15
PID 1952 wrote to memory of 1416	1952	b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1416
- C:\Users\Admin\AppData\Local\Temp\b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe
  "C:\Users\Admin\AppData\Local\Temp\b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Users\Admin\AppData\Local\Temp\b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe
    C:\Users\Admin\AppData\Local\Temp\b481683fe85e4025aff66d905377b7cbe7de5920dbd6b72821cebf5ad47b8f27.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/736-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/736-56-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/736-57-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/736-58-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/736-59-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/736-60-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/736-61-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/736-62-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/736-63-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/736-55-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/736-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1416-75-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1952-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-73-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1952-74-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1952-78-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing