cefdef740c48781321a1d5ea1fb2e13f4b5a2c8858986b2afef44de8af51e8eb

General

Target

0be141f64e70b88b08e6490d01718fa2.exe
Size

16.2MB
MD5

0be141f64e70b88b08e6490d01718fa2
SHA1

9c32e1097013547d26b43470d5f0d862d058c09a
SHA256

cefdef740c48781321a1d5ea1fb2e13f4b5a2c8858986b2afef44de8af51e8eb
SHA512

7075fccf785cf58fb1b9e12099b7cc2bdb9600225aa25b7448011bd81ae9995227be6441231c26abbadc091f0eb29c526367a268bdf60f359a393dea35b2da37
SSDEEP

24576:cVU777777777yplplplplplplplplplpr:cn

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1632	cdfxbmg.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4400-0-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/1632-56-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/1632-39-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-57-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-58-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-59-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-60-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-61-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-62-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-63-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4400-64-0x0000000000400000-0x000000000046D000-memory.dmp	upx

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Help\1.istljvi	0be141f64e70b88b08e6490d01718fa2.exe
File created	C:\Windows\SysWOW64\Help\2.istljvi	0be141f64e70b88b08e6490d01718fa2.exe
File created	C:\Windows\SysWOW64\istljvi\istljvi\kcdvusi\m.ini	0be141f64e70b88b08e6490d01718fa2.exe
File created	C:\Windows\SysWOW64\istljvi\istljvi\kcdvusi\cdfxbmg.exe	0be141f64e70b88b08e6490d01718fa2.exe
File opened for modification	C:\Windows\SysWOW64\istljvi\istljvi\kcdvusi\cdfxbmg.exe	0be141f64e70b88b08e6490d01718fa2.exe
File created	C:\Windows\system32\spool\DRIVERS\W32X86\3\stljvii\stljvii.exe	0be141f64e70b88b08e6490d01718fa2.exe
File created	C:\Windows\SysWOW64\Help\upbiran.ini	0be141f64e70b88b08e6490d01718fa2.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Help\istljvi.hlp	0be141f64e70b88b08e6490d01718fa2.exe
File created	C:\Windows\2.ini	0be141f64e70b88b08e6490d01718fa2.exe
File opened for modification	C:\Windows\	0be141f64e70b88b08e6490d01718fa2.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4400	0be141f64e70b88b08e6490d01718fa2.exe
4400	0be141f64e70b88b08e6490d01718fa2.exe
4400	0be141f64e70b88b08e6490d01718fa2.exe
4400	0be141f64e70b88b08e6490d01718fa2.exe
4400	0be141f64e70b88b08e6490d01718fa2.exe
4400	0be141f64e70b88b08e6490d01718fa2.exe
4400	0be141f64e70b88b08e6490d01718fa2.exe
4400	0be141f64e70b88b08e6490d01718fa2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	0be141f64e70b88b08e6490d01718fa2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1632	4400	0be141f64e70b88b08e6490d01718fa2.exe	94
PID 4400 wrote to memory of 1632	4400	0be141f64e70b88b08e6490d01718fa2.exe	94
PID 4400 wrote to memory of 1632	4400	0be141f64e70b88b08e6490d01718fa2.exe	94
PID 1632 wrote to memory of 3228	1632	cdfxbmg.exe	95
PID 1632 wrote to memory of 3228	1632	cdfxbmg.exe	95
PID 1632 wrote to memory of 3228	1632	cdfxbmg.exe	95

C:\Users\Admin\AppData\Local\Temp\0be141f64e70b88b08e6490d01718fa2.exe
"C:\Users\Admin\AppData\Local\Temp\0be141f64e70b88b08e6490d01718fa2.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\istljvi\istljvi\kcdvusi\cdfxbmg.exe
  C:\Windows\system32\istljvi\istljvi\kcdvusi\cdfxbmg.exe -close
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -NetworkService
    3⤵
    PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-39-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1632-56-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3228-55-0x0000000000010000-0x0000000000010000-memory.dmp

Download
memory/4400-61-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-57-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-58-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-59-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-60-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-62-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-63-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-64-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-65-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-66-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-67-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-68-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-69-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4400-70-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing