e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271

General

Target

e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
Size

3.6MB
MD5

168eca82af2c03881fecdec4447ff9a5
SHA1

aedaae101d8e757efa03cb6641739cce65870228
SHA256

e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271
SHA512

a5260cec69a6a8bf23a47eaadd7eafc08673faf25c0d97d3f5ae7fbfe09c7ae8b3ee6298acf368acb2c076a4abd91336e07983da69d68901d4e0680460ac7151
SSDEEP

98304:a+EgW6sZe9fcMrrwtTBruYPziOOo/s+I09KZB6v6JIUC0:aWdsZeJcMrrCTBtiOObvtZIv6J7/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1224-21-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-23-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-25-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-26-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-28-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-37-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-40-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-43-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/1224-45-0x0000000010000000-0x00000000100BE000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1224 set thread context of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
472	subst.exe
472	subst.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
472	subst.exe
472	subst.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94
PID 1224 wrote to memory of 472	1224	e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe	94

C:\Users\Admin\AppData\Local\Temp\e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
"C:\Users\Admin\AppData\Local\Temp\e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\subst.exe
  C:\Windows\SysWOW64\subst.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\RSkinFSystem.ini

Filesize
129B

MD5
78d89536fa344a82364f1dda81d78f3a

SHA1
e866b4f7713f3b6718c2b4b836937c8b35ff7c31

SHA256
32c064c7c56cae4ea4ee32cf8ee2f110f2f715ed064c28c1a5e5b4b384439fa5

SHA512
2a04d9ea26e8617c60f5af189f2fce74baf151bb414390aa617adf140bce277d492764dc7a34671d0a09c61edebbd0b9f8d3ce591a2d6d54f66495f53cce6d58

Download Submit
C:\RSkinFSystem.ini

Filesize
129B

MD5
78d89536fa344a82364f1dda81d78f3a

SHA1
e866b4f7713f3b6718c2b4b836937c8b35ff7c31

SHA256
32c064c7c56cae4ea4ee32cf8ee2f110f2f715ed064c28c1a5e5b4b384439fa5

SHA512
2a04d9ea26e8617c60f5af189f2fce74baf151bb414390aa617adf140bce277d492764dc7a34671d0a09c61edebbd0b9f8d3ce591a2d6d54f66495f53cce6d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\1224_update\7z.7z

Filesize
3.4MB

MD5
f4ece332b5112f8cf6e3173fa883bafe

SHA1
29fe526543de54f8f52d0405c0b0a4f23b9c5fa5

SHA256
c330d1a5155944c8cc7fd850fe69d291d451042174c1893b6418f82423f376c1

SHA512
380f4c1d62a1282ce718d5770bbb7e65148989ce6a53c144324bd95844b9446dd63c6afe965de3e7780eef91bf8a5d7e8e8252bfb4f7ef036d97d904351704e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1224_update\data.ini

Filesize
177B

MD5
3afd57e38d08f539c0ef64c64e784266

SHA1
7285aadc714a9c124af342a993c17a2d815fb355

SHA256
c31e70edc39c1053f31a71c5d29dbf76e25b7ac8e78bbd34a825f15407745d85

SHA512
9155c3f917d91889020af4471045f2b9ff851c57d06e3b03b172da44bb4b55329de9526f60b2d0ea521ae6f3a4ccf204c31fb31c805d7285bbe5f3a22d733c6d

Download Submit
memory/472-49-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/472-54-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/472-51-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/472-52-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/472-50-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/1224-23-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-26-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-37-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-40-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-43-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-45-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-28-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-35-0x0000000000400000-0x0000000001039000-memory.dmp

Filesize
12.2MB

Download
memory/1224-25-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-0-0x0000000000400000-0x0000000001039000-memory.dmp

Filesize
12.2MB

Download
memory/1224-21-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1224-3-0x0000000000400000-0x0000000001039000-memory.dmp

Filesize
12.2MB

Download
memory/1224-2-0x0000000000400000-0x0000000001039000-memory.dmp

Filesize
12.2MB

Download
memory/1224-1-0x0000000000400000-0x0000000001039000-memory.dmp

Filesize
12.2MB

Download
memory/1224-58-0x0000000000400000-0x0000000001039000-memory.dmp

Filesize
12.2MB

Download

Analysis

Sharing