1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8

General

Target

1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
Size

536KB
MD5

65ba33194af74b823397b0c58dd08431
SHA1

84cbd61cf50ebf943f1bdea7798feb03c145b227
SHA256

1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8
SHA512

c9806279df04d989d89cd6b1baf90de51043f071b1a1443e3c6a7421be77673c8a08cd70b4b6bd5505991a000c197fb9e1bcf0234f21e8279503f229d09f6497
SSDEEP

12288:4hf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:4dQyDL9xp/BGA1RkmOkx2LF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-0-0x0000000000C60000-0x0000000000D62000-memory.dmp	upx
behavioral1/memory/2876-1-0x0000000000C60000-0x0000000000D62000-memory.dmp	upx
behavioral1/memory/2876-9-0x0000000000C60000-0x0000000000D62000-memory.dmp	upx
behavioral1/memory/2876-337-0x0000000000C60000-0x0000000000D62000-memory.dmp	upx
behavioral1/memory/2876-705-0x0000000000C60000-0x0000000000D62000-memory.dmp	upx
behavioral1/memory/2876-716-0x0000000000C60000-0x0000000000D62000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114
Destination IP	223.5.5.5
Destination IP	114.114.114.114
Destination IP	223.5.5.5

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\313cf8	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
Token: SeTcbPrivilege	2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
Token: SeDebugPrivilege	2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
Token: SeDebugPrivilege	1220	Explorer.EXE
Token: SeTcbPrivilege	1220	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1220	2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe	8
PID 2876 wrote to memory of 1220	2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe	8
PID 2876 wrote to memory of 1220	2876	1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe	8

C:\Users\Admin\AppData\Local\Temp\1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe
"C:\Users\Admin\AppData\Local\Temp\1cebba4ae9fccf657445f2cc261e632ffdad42d3187f89c738f04802c53c88f8.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a7002cc5b40bfaa5865fd0c6bf608f2

SHA1
635734772474d0ef45af32dcc09532ee83a9a0af

SHA256
abf7af06ee8f133a51fe9027c0e38c088a4838c32a9969a5e53baacdac745298

SHA512
8eccd915522fd2ce944908e9d278421c1bfc6de2b166cbf3d614caa1c74065f4e90160273e29ed806c14777807a989955fb1cd6fed98054e442b4a0dca12c6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31a062ad487f22e4c193ec5d4dd0b1c7

SHA1
f4de58a3544cafa25ebde8604f5da268f8089997

SHA256
4cafaa2753b58282ae7f9687290a3fdb2a897a151d2469fb9036a3fd18ced8d8

SHA512
142562ad671199acf9f6674c025dac9ff17d05545f6c5631a0250b04ddf3b9e9695e2253941459bada5ce9fddf084b127cbd3bc343f946e660356c9ce19132b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928a1f4471820658d540d71ab746869a

SHA1
9fadbc95d9bd60c8766df864630dc67374e3ca75

SHA256
e3edf9c0513a7610a9a52aa769f22cfa585633bbb89652ba7779e589a78f3381

SHA512
a370b00f55ce4a18faad21b586dfc7f4b4cff96c7341be61d7ec4dca7c0e5d0d6e02fe650baa29f39fff3b8b251a2671844873bc857900f60b2c085ddb0a532a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6B0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF6D2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1220-7-0x0000000003910000-0x0000000003989000-memory.dmp

Filesize
484KB

Download
memory/1220-11-0x0000000003910000-0x0000000003989000-memory.dmp

Filesize
484KB

Download
memory/1220-5-0x0000000001DD0000-0x0000000001DD3000-memory.dmp

Filesize
12KB

Download
memory/1220-4-0x0000000001DD0000-0x0000000001DD3000-memory.dmp

Filesize
12KB

Download
memory/2876-9-0x0000000000C60000-0x0000000000D62000-memory.dmp

Filesize
1.0MB

Download
memory/2876-0-0x0000000000C60000-0x0000000000D62000-memory.dmp

Filesize
1.0MB

Download
memory/2876-337-0x0000000000C60000-0x0000000000D62000-memory.dmp

Filesize
1.0MB

Download
memory/2876-1-0x0000000000C60000-0x0000000000D62000-memory.dmp

Filesize
1.0MB

Download
memory/2876-705-0x0000000000C60000-0x0000000000D62000-memory.dmp

Filesize
1.0MB

Download
memory/2876-716-0x0000000000C60000-0x0000000000D62000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing