eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1

General

Target

eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1.exe
Size

2.2MB
MD5

198411d101ad36ba54321ead0bda2985
SHA1

b1f10cd4ca8c37f03cc8381d89878aa6d3a853e3
SHA256

eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1
SHA512

972c7561bf6aba173394d72dbfc09c1fe783015d6a1dd5187aee9bbb41474677eb99511d73bba2d82f85fb1085bbc90a62f1be98e4c87e8e1fbab33c6c468870
SSDEEP

49152:7NmlepCR1eOiOr8kakbPOmKL+RivXYmoyNMNMsM0:aR1eOiOHxbPJKL+R1TyNMNMsM0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-54-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-55-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-56-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-58-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-60-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-62-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-64-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-68-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-70-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-72-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-74-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-76-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-78-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-80-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-84-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-86-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-88-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-92-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-94-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-90-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-82-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-66-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-96-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2012-97-0x00000000003A0000-0x00000000003DE000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2012	eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1.exe
2012	eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1.exe
2012	eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1.exe

C:\Users\Admin\AppData\Local\Temp\eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1.exe
"C:\Users\Admin\AppData\Local\Temp\eb5a458efecd33f4c8a003010f68e153f498b67236a581f1a5e0e95b28bb5ce1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-55-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-56-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-58-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-60-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-62-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-64-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-68-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-70-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-72-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-74-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-76-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-78-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-80-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-84-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-86-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-88-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-92-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-94-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-90-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-82-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-66-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-96-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2012-97-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing