2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6

General

Target

2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe
Size

6.1MB
MD5

485796776db1d4837b3049cbe9525733
SHA1

b2c762839bebb2e005524a1c7386dedd9ed8fd7c
SHA256

2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6
SHA512

d368d7f77ca29dddd5d60307686902f43df0a7c2a01eb7e4b995dc3f9d4bd10ad1d1f3fca99e3649b5d7d4349a36fba6726e5ce3090bee06b78e5a99ed149c81
SSDEEP

98304:Y4dcISgILTJGgncmfcAJJ910NVVFJXrZpsiYKAHi/PDt+a5mkzOcy01cThuc4zlo:WVgfdOF6EIKD9m+V

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4696-1-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-2-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-3-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-5-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-7-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-9-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-11-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-14-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-16-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-18-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-20-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-22-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-24-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-26-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-28-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-30-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-32-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-34-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-36-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-38-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-40-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-42-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-44-0x0000000002970000-0x00000000029AE000-memory.dmp	upx
behavioral2/memory/4696-51-0x0000000002970000-0x00000000029AE000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe
4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe
4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe
4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe
4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4824	4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe	92
PID 4696 wrote to memory of 4824	4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe	92
PID 4696 wrote to memory of 4824	4696	2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe	92

C:\Users\Admin\AppData\Local\Temp\2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe
"C:\Users\Admin\AppData\Local\Temp\2b9a25e92cab7f36cb0be3dd69491a147d29047e04d7c6825095589da8c57ca6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s dm.dll
  2⤵
  PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pz.ini

Filesize
54B

MD5
db5c1eb2c9ad3ead473c725aa5bd900b

SHA1
006a0ef8f902f45f50638055c6872793ff2c21a4

SHA256
fd052660a2da7cc85fe056dbd8dd9a211eec06e2b480dbab75e12ed3dfa48b31

SHA512
42b53be4364b376dfbc68db361e79e773c1f5168a589423934145384e64674a8677df68379104ac839ec5ba34a9684c52822b16d4fa0703abd7ffe5618c39f03

Download Submit
memory/4696-24-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-14-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-5-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-7-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-9-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-11-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-1-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-16-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-18-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-20-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-3-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-22-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-34-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-28-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-30-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-32-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-26-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-36-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-38-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-40-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-42-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-44-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-2-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download
memory/4696-51-0x0000000002970000-0x00000000029AE000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing