d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd

General

Target

d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe
Size

1.8MB
MD5

e91f0abe83be2212b7f47fb7bd363fcc
SHA1

858624d7c8822fca044dc4555f79ace368f6364a
SHA256

d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd
SHA512

156f12971ffcb78a5b7bd6f9f21f91e4d3dc31af6ac7f64328895c7526da4b9bc060165384f28d1a4a4e31e049662f72ae5abc86a362f8e195b22d2023ecb542
SSDEEP

24576:SkLnwea0VFslrMlj9dzHVJ5wzAoZ2xxjiAAE2XdsbLehGHDCPeDnTG3Z:SQH+YLJ5H+vHKwr6q

Score

10^/10

upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process
PID 3020 created 0	3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3020-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3020-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe
3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe
3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe
3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2796	3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe	28
PID 3020 wrote to memory of 2796	3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe	28
PID 3020 wrote to memory of 2796	3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe	28
PID 3020 wrote to memory of 2796	3020	d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe	28

C:\Users\Admin\AppData\Local\Temp\d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe
"C:\Users\Admin\AppData\Local\Temp\d866d5a8e2e4388b56a76e990e8c910fe25c1bacd6afef04441a2800b37cb2cd.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\System32\cmd.exe
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3020-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing