328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b

General

Target

328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe
Size

726KB
MD5

0c1c32e6aaaf8a61f2423696d402d405
SHA1

3001a7260882230b9325f3b3650e0d57f309a080
SHA256

328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b
SHA512

d1d3c71958c39103f0a8c1098d2b9d1d4e2909b6b29af0ecd864295e40e8a097d87a925248423758166f775aae78565fc691025bb06c87d69749694c132287eb
SSDEEP

12288:qwS0M/G9YVmkLkfrHrNyhpARPN4hYFzF4J1AOOchasfofZ/RVl1hqjmAv4ZoNdoX:U0aVCrNApARPGNJ6OxhasfE/Rn15ZoP/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2660-0-0x000000013FE90000-0x000000013FFC7000-memory.dmp	upx
behavioral1/memory/2660-42-0x000000013FE90000-0x000000013FFC7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe
1236	taskhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe
Token: SeIncBasePriorityPrivilege	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 1236	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	12
PID 2660 wrote to memory of 2316	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	28
PID 2660 wrote to memory of 2316	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	28
PID 2660 wrote to memory of 2316	2660	328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe	28

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236

C:\Users\Admin\AppData\Local\Temp\328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe
"C:\Users\Admin\AppData\Local\Temp\328c9293816116622268f1c3af4f7d8439498cb8cbb023935722da17385bc39b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\328C92~1.EXE > nul
  2⤵
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-20-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/1236-32-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-4-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-6-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-8-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-10-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-12-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-16-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-43-0x0000000001B50000-0x0000000001B51000-memory.dmp

Filesize
4KB

Download
memory/1236-1-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-14-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-22-0x0000000001B50000-0x0000000001B51000-memory.dmp

Filesize
4KB

Download
memory/1236-23-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-25-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-26-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-28-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-30-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/1236-18-0x0000000001E50000-0x0000000001F5B000-memory.dmp

Filesize
1.0MB

Download
memory/2660-42-0x000000013FE90000-0x000000013FFC7000-memory.dmp

Filesize
1.2MB

Download
memory/2660-0-0x000000013FE90000-0x000000013FFC7000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing