99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349

General

Target

99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349.exe
Size

3.1MB
MD5

21abc36a16937f6d7f25514ddb5ddec1
SHA1

0e61e014b4cc4bd1af1e429457801b336e261856
SHA256

99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349
SHA512

5c088c15d4f6b7dae2853474e05a8599c85139c0d099cfced5edd02d69e6979e21d0dc134cc0a8a312d9a0c55d11f7b33a8b4ba9fa8c15b484dc864411c1356d
SSDEEP

98304:PO66M9A4Hg0Ebirajf7q78yMVWqzuRjZIoxTS5JwVYUa3ocmvXAksTTp1TXUtXVL:PO66M9A4Hg0Ebirajf7q78yMVWqzuRjm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3096-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3096-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3096	99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349.exe
3096	99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349.exe
3096	99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349.exe

C:\Users\Admin\AppData\Local\Temp\99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349.exe
"C:\Users\Admin\AppData\Local\Temp\99281602e897e66f0834e8b76251458bda4aa4c28d1999ac612ce7532d0ec349.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3096-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-45-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/3096-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3096-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing