71bd50460cc787c6eb8f67a15c3540d86176003ddc8138a4eebc2eef97fdd507

General

Target

17f9fec4e62f54b862217e237af84c04.exe
Size

348KB
MD5

17f9fec4e62f54b862217e237af84c04
SHA1

011d462b4946cd7b7b4afcd6286011281d490fa5
SHA256

71bd50460cc787c6eb8f67a15c3540d86176003ddc8138a4eebc2eef97fdd507
SHA512

01d7592ce1dab8605314b4740e782e1c0d39bb9b896ef25b3a226c0dd7cadc6c7528c02d7feebabe9a014cfdec6c8a5472744f7c9c18e021a3f351a471991f78
SSDEEP

6144:9uowxDDu+f4/KLm8SfLWjW/IycmgX4dztn9/5JX2OrJifw11razBDEcw1F1V:Qow0+lqWjWPdztnd5JGM0Ija1Cz1V

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6136-4-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/6136-7-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/6136-18-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/6136-9-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 set thread context of 0	2776	17f9fec4e62f54b862217e237af84c04.exe
PID 6136 set thread context of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4680	17f9fec4e62f54b862217e237af84c04.exe
4680	17f9fec4e62f54b862217e237af84c04.exe
4680	17f9fec4e62f54b862217e237af84c04.exe
4680	17f9fec4e62f54b862217e237af84c04.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	17f9fec4e62f54b862217e237af84c04.exe
6136	17f9fec4e62f54b862217e237af84c04.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 6136	2776	17f9fec4e62f54b862217e237af84c04.exe	26
PID 2776 wrote to memory of 0	2776	17f9fec4e62f54b862217e237af84c04.exe
PID 2776 wrote to memory of 0	2776	17f9fec4e62f54b862217e237af84c04.exe
PID 2776 wrote to memory of 0	2776	17f9fec4e62f54b862217e237af84c04.exe
PID 2776 wrote to memory of 0	2776	17f9fec4e62f54b862217e237af84c04.exe
PID 2776 wrote to memory of 0	2776	17f9fec4e62f54b862217e237af84c04.exe
PID 6136 wrote to memory of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28
PID 6136 wrote to memory of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28
PID 6136 wrote to memory of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28
PID 6136 wrote to memory of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28
PID 6136 wrote to memory of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28
PID 6136 wrote to memory of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28
PID 6136 wrote to memory of 4680	6136	17f9fec4e62f54b862217e237af84c04.exe	28
PID 4680 wrote to memory of 3420	4680	17f9fec4e62f54b862217e237af84c04.exe	50
PID 4680 wrote to memory of 3420	4680	17f9fec4e62f54b862217e237af84c04.exe	50
PID 4680 wrote to memory of 3420	4680	17f9fec4e62f54b862217e237af84c04.exe	50
PID 4680 wrote to memory of 3420	4680	17f9fec4e62f54b862217e237af84c04.exe	50

C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe
"C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe
  "C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe
    "C:\Users\Admin\AppData\Local\Temp\17f9fec4e62f54b862217e237af84c04.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-0-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/2776-2-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/2776-11-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/3420-23-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3420-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4680-16-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4680-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4680-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4680-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4680-20-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4680-28-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4680-27-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/6136-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/6136-9-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/6136-7-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/6136-4-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing