4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9

General

Target

4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
Size

536KB
MD5

50ca59b1337fd05ac7e4801d1f0615b4
SHA1

12a223fdf7fdbcfde6043c29b61df08c2381b607
SHA256

4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9
SHA512

3c3b9c28b8335ad4b25174c42bd83f0fc35de76da992f679f1364be72d7199eb34ce4368227399835c488674850dfde51ebb27ff53350d9259c9715039aa354f
SSDEEP

12288:rhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:rdQyDLzJTveuK0/Okx2LF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1692-0-0x0000000000F50000-0x0000000001052000-memory.dmp	upx
behavioral1/memory/1692-44-0x0000000000F50000-0x0000000001052000-memory.dmp	upx
behavioral1/memory/1692-420-0x0000000000F50000-0x0000000001052000-memory.dmp	upx
behavioral1/memory/1692-479-0x0000000000F50000-0x0000000001052000-memory.dmp	upx
behavioral1/memory/1692-576-0x0000000000F50000-0x0000000001052000-memory.dmp	upx
behavioral1/memory/1692-616-0x0000000000F50000-0x0000000001052000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	114.114.114.114

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\1cf7b8	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
1356	Explorer.EXE
1356	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
Token: SeTcbPrivilege	1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
Token: SeDebugPrivilege	1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
Token: SeDebugPrivilege	1356	Explorer.EXE
Token: SeTcbPrivilege	1356	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1356	Explorer.EXE
1356	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1356	Explorer.EXE
1356	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1356	1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe	7
PID 1692 wrote to memory of 1356	1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe	7
PID 1692 wrote to memory of 1356	1692	4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe	7

C:\Users\Admin\AppData\Local\Temp\4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
"C:\Users\Admin\AppData\Local\Temp\4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5a241438ce73f4e295e4d8fac33ddf4

SHA1
649062b4531fc93940a30342fab605a8010fc7b5

SHA256
5954d0c3c3d483aef7af4ad85448f40b77f8cd96ea1de48d8482f89face6d70b

SHA512
be39c642c0067864cb81100f0bf6285931e1dc4a1e4768d1d10c60dc88e4495816fcf01b1a5e4a2bbc653bb49259c94ca809f0b8da59fb9527e10295541767cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4456797abcc1e0c32b4aeb7d50ecd43

SHA1
b2d625bd4a02222335b9d9c1225f8baf9cdf5484

SHA256
ebefc59d810bbde5311fd72d64681a0aa4c47d936cf300f5d8869bfcf9470deb

SHA512
cf86d3e7c9c36424c7bde382adc845bb51393eacab3280e0d5be6e58e69e43badf7b46638207b5b6b0c6d90eecd3c99e50bfaac5a0d72c10d785e42a30a4c336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
104c3a0b13fc19e63c18c3ec6624388f

SHA1
d94110e784b7b31d0ca0214ab0f70e2f59ac33e5

SHA256
fbab24385dee49daf0b2dc14838ed155c30fd6ccc4f63f2d41dc4de7b2bbf5c0

SHA512
b55d86f530b09e8339bdc505d32f165050b04b487a103bc9b79213de93ba882499a8a8ad065f402254ee0f71a3230e8c02839844dc58702c6a60dca07fc50785

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BB0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1356-4-0x0000000002A70000-0x0000000002A73000-memory.dmp

Filesize
12KB

Download
memory/1356-7-0x00000000040F0000-0x0000000004169000-memory.dmp

Filesize
484KB

Download
memory/1356-5-0x00000000040F0000-0x0000000004169000-memory.dmp

Filesize
484KB

Download
memory/1356-238-0x00000000040F0000-0x0000000004169000-memory.dmp

Filesize
484KB

Download
memory/1356-6-0x0000000002A70000-0x0000000002A73000-memory.dmp

Filesize
12KB

Download
memory/1356-3-0x0000000002A70000-0x0000000002A73000-memory.dmp

Filesize
12KB

Download
memory/1692-44-0x0000000000F50000-0x0000000001052000-memory.dmp

Filesize
1.0MB

Download
memory/1692-0-0x0000000000F50000-0x0000000001052000-memory.dmp

Filesize
1.0MB

Download
memory/1692-420-0x0000000000F50000-0x0000000001052000-memory.dmp

Filesize
1.0MB

Download
memory/1692-479-0x0000000000F50000-0x0000000001052000-memory.dmp

Filesize
1.0MB

Download
memory/1692-576-0x0000000000F50000-0x0000000001052000-memory.dmp

Filesize
1.0MB

Download
memory/1692-616-0x0000000000F50000-0x0000000001052000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing