cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7

General

Target

cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe
Size

1.6MB
MD5

fca2d81f94be82acc86b3e9535210ebd
SHA1

51449de25de958fa8b36f8e98f3d95b79f70ad6b
SHA256

cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7
SHA512

fc54547e000aba68c40a8b4a5f1fbf89b6e32753e282359382838b9aba783871a6fe44fdeabd919fe08d767af5fefcacae6efb6ce658376b5d03fe853a693c0d
SSDEEP

24576:0QzAsvbY7qZBevNU2aogCEbteQeaHDJqhoZewVKMfaqzwOqLM0:0yyqCmeGqhoDMM/zdqD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-1-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-10-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-13-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-15-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-20-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-22-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-25-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-27-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-29-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-33-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-31-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-36-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-40-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-38-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-43-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-47-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-45-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-50-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2508-51-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\default_page_url = "http://591314.org/?soft"	cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://591314.org/?soft"	cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2508	cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe
2508	cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe
2508	cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe
2508	cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe

C:\Users\Admin\AppData\Local\Temp\cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe
"C:\Users\Admin\AppData\Local\Temp\cc484694f24b864319db7bafb8c3d691df01928fd36c3906a2c9e04df447e1c7.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-1-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-10-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-13-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-15-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-20-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-22-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-25-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-27-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-29-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-33-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-31-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-36-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-40-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-38-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-43-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-47-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-45-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-50-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2508-51-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads