3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af

General

Target

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
Size

16.8MB
MD5

0ee4fb241171bccc49b242101ad50901
SHA1

a8b3e341d88a56ca73ce15aa3ddcebddfac29c09
SHA256

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af
SHA512

10a54e85f38d976801ad9fa123c4dd8c044b54ec35f87b6463540eaf2e1a12976f85fd6c2e5c25b9b536982c20e1c9d2e21854db9e6a87a2ccce158efde8c305
SSDEEP

196608:mU7d9xZSt4U7d9xZStSU7d9xZSt4U7d9xZStmalLXx:n7d9xZo7d9xZS7d9xZo7d9xZ9alLX

Score

7^/10

persistence upx

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1320-55-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

description	pid	process	target process
PID 1320 set thread context of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 set thread context of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 set thread context of 1492	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

pid process

1320 3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

pid	process
1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
980	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
980	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe

C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
"C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
2⤵
- Drops startup file
PID:1056

C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
C:\Users\Admin\AppData\Local\Temp\3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
3⤵
- Suspicious use of SetWindowsHookEx
PID:980

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
3⤵
PID:1492

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-94-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-119-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-116-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-103-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-96-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-98-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1192-67-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-86-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-65-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-66-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-56-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/1192-68-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-69-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-70-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-71-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-72-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1192-74-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-77-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-76-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-78-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-79-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-80-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-81-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-83-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-85-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-84-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-64-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-88-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-87-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1192-89-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-91-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1192-63-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-57-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-61-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-60-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-59-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-58-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1192-115-0x00000000089F0000-0x0000000008A39000-memory.dmp

Filesize
292KB

Download
memory/1192-111-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-110-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1320-62-0x0000000000450000-0x0000000000499000-memory.dmp

Filesize
292KB

Download
memory/1320-55-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1492-106-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1492-113-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1492-114-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1492-104-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1492-105-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 1320 wrote to memory of 1056	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	cmd.exe
PID 1320 wrote to memory of 1056	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	cmd.exe
PID 1320 wrote to memory of 1056	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	cmd.exe
PID 1320 wrote to memory of 1056	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	cmd.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1320 wrote to memory of 1192	1320	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 980	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe
PID 1192 wrote to memory of 1492	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe
PID 1192 wrote to memory of 1492	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe
PID 1192 wrote to memory of 1492	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe
PID 1192 wrote to memory of 1492	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe
PID 1192 wrote to memory of 1492	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe
PID 1192 wrote to memory of 1492	1192	3af6bf3832ef4fca74ee05e5d824bdf56bda49558221d2444acc423e12c226af.exe	diskperf.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads