71bd50460cc787c6eb8f67a15c3540d86176003ddc8138a4eebc2eef97fdd507

General

Target

17f9fec4e62f54b862217e237af84c04.exe
Size

348KB
MD5

17f9fec4e62f54b862217e237af84c04
SHA1

011d462b4946cd7b7b4afcd6286011281d490fa5
SHA256

71bd50460cc787c6eb8f67a15c3540d86176003ddc8138a4eebc2eef97fdd507
SHA512

01d7592ce1dab8605314b4740e782e1c0d39bb9b896ef25b3a226c0dd7cadc6c7528c02d7feebabe9a014cfdec6c8a5472744f7c9c18e021a3f351a471991f78
SSDEEP

6144:9uowxDDu+f4/KLm8SfLWjW/IycmgX4dztn9/5JX2OrJifw11razBDEcw1F1V:Qow0+lqWjWPdztnd5JGM0Ija1Cz1V

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2084-5-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2084-8-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2084-7-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2084-11-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2084-19-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 set thread context of 0	2176	17f9fec4e62f54b862217e237af84c04.exe
PID 2084 set thread context of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	17f9fec4e62f54b862217e237af84c04.exe
1468	17f9fec4e62f54b862217e237af84c04.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2176	17f9fec4e62f54b862217e237af84c04.exe
2084	17f9fec4e62f54b862217e237af84c04.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 2084	2176	17f9fec4e62f54b862217e237af84c04.exe	28
PID 2176 wrote to memory of 0	2176	17f9fec4e62f54b862217e237af84c04.exe
PID 2176 wrote to memory of 0	2176	17f9fec4e62f54b862217e237af84c04.exe
PID 2176 wrote to memory of 0	2176	17f9fec4e62f54b862217e237af84c04.exe
PID 2176 wrote to memory of 0	2176	17f9fec4e62f54b862217e237af84c04.exe
PID 2176 wrote to memory of 0	2176	17f9fec4e62f54b862217e237af84c04.exe
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 2084 wrote to memory of 1468	2084	17f9fec4e62f54b862217e237af84c04.exe	29
PID 1468 wrote to memory of 1260	1468	17f9fec4e62f54b862217e237af84c04.exe	14
PID 1468 wrote to memory of 1260	1468	17f9fec4e62f54b862217e237af84c04.exe	14
PID 1468 wrote to memory of 1260	1468	17f9fec4e62f54b862217e237af84c04.exe	14
PID 1468 wrote to memory of 1260	1468	17f9fec4e62f54b862217e237af84c04.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe
  "C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe
    "C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe
      "C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-23-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1260-26-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1468-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1468-37-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1468-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1468-16-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1468-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1468-36-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1468-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2084-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2084-7-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2084-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2084-11-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2084-19-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2176-9-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/2176-1-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/2176-4-0x0000000002A80000-0x0000000002BE0000-memory.dmp

Filesize
1.4MB

Download
memory/2176-0-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing