f52abb93e1ab43b8295408e5a28e455e5f1229870a6df04eab96ff38a9a0e050

General

Target

4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.exe
Size

1.9MB
MD5

7ad5aeea9f845dd03f690d74bceda6f7
SHA1

0141c446a065d5808ad8bcc22086534d6cda0641
SHA256

4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa
SHA512

bc96ac20d6c19b694d6dd8fb33b116f07177de32dc0e13ad419feeaec352907c954ba5a932de0c915ff53d52b512de0f9f273815be84a482728f4eedd9870b18
SSDEEP

49152:kKQS+9lSeIj+B3lrUccm/rM1HQmR54E5tSxak:jx4S2WxmYfjRthk

Score

8^/10

persistence upx

Malware Config

Signatures

Downloads MZ/PE file

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-11-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-14-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-102-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-180-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-246-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-329-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-398-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-479-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-547-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-624-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-701-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-776-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-851-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-907-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx
behavioral1/memory/2336-975-0x0000000000400000-0x0000000000BCB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\Anchortools Launcher = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.exe"	4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2336	4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.exe

C:\Users\Admin\AppData\Local\Temp\4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.exe
"C:\Users\Admin\AppData\Local\Temp\4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.log

Filesize
677B

MD5
aa807c6f9bdd599a2b3cca6a51a94e03

SHA1
6c8a3ff13b02732915c8dd106bf40f1c2ef62d9b

SHA256
7c1d7320d39374a31e5b8df855a2269a0e4cb89d8e91b31d1219704205ee31fe

SHA512
6bdb04ee066f8340a7a256c1462102d8c22bd62442306617aba13d51335a8d56c242d88947a9aedc1b8a8976836b6b2db401185124c88d833bd87d8d6363ead8

Download Submit
C:\Users\Admin\AppData\Local\Temp\4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.log

Filesize
4KB

MD5
21f0e63573eed34c32d561441c2d568f

SHA1
752e5e314e46149ca43da37b3e9bf730701608d2

SHA256
e2c6e19fccd6ab6d873e4b7762ed55385fadbccbd411a4d3493c690140ce6b8e

SHA512
6466cb7199c3c88316a94b38fb54ef1fe492de3b24a192953611014bd034fcf4d776d734b9c368f9058eb1525518617902deca8947c8307317533b3db5ee9302

Download Submit
C:\Users\Admin\AppData\Local\Temp\4e90cb2a696f3f777c5789e8613bd26a4bd897c9b4ca0d8ea42f0338aa3db3aa.log

Filesize
207B

MD5
07e50bf6ac033cc560a0713e160da92d

SHA1
1e21bb486b1460445d211e7585613b4075fc2ed8

SHA256
f4450d1545001d48b53c17ee79d7f0a76873f6b4ac9f1af837b386f70afe79c0

SHA512
5089b79f3df3719ea4977390102818286101b88e8a914f358ad4b8d464c248672e2ee925a688d84c2c4a32c879d59407be13b653d484cba28b2ea39c4302236d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mls.lst

Filesize
176B

MD5
d454f1aeec8d116e23f4bdec1f25e547

SHA1
08432c748c90a053db7c99d022cbc3565ec0f9f3

SHA256
708809a6b087395dcd58457e69364207f92e6b7e56257e4ccebf8f643b0151c2

SHA512
4bf571053ea535ae4d988fa1688b925251dab5f8ce7f204ab6fa824aa6727321323d22906f8ee16841c02b7e8c24cddb38bc0737069a3c8e6e59757069266df8

Download Submit
memory/2336-180-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-398-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-11-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-39-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2336-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2336-102-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-0-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-246-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-329-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-14-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-479-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-547-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-624-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-701-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-776-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-851-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-907-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download
memory/2336-975-0x0000000000400000-0x0000000000BCB000-memory.dmp

Filesize
7.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads