7d7943144983d93c7910b207dc53f102b1818da583f2166de3422905e89c2d27

General

Target

37cb991688b505c3fe252f852ff4cfda.exe
Size

292KB
MD5

37cb991688b505c3fe252f852ff4cfda
SHA1

1183bfdf21e46a9a731b06166637549a4390474f
SHA256

7d7943144983d93c7910b207dc53f102b1818da583f2166de3422905e89c2d27
SHA512

aedb9ae785000ad3d3705df620307e3dfb1af74060936849ddc81887cd050aeac1493dc94c4572b4d3ba17f9bc418b8cad7f19e56a9ca707096ba45860a2946e
SSDEEP

6144:Yd0NCFu2a/eqqflQm4sQDLyg7bK+p+fr/wGVRKMm/EiVyEdwkuDGUroSa:Yd0NCFAWq3sQD+24VzA8iVyEdwkVioSa

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1140-0-0x0000000000400000-0x0000000000483000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

37cb991688b505c3fe252f852ff4cfda.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\KeApplet = "C:\\Users\\Admin\\AppData\\Roaming\\Opera\\{40CA74AF-EBC4-4FAA-B21E-D13AB5B82111}\\Validator.exe"	37cb991688b505c3fe252f852ff4cfda.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\KeApplet = "C:\\Users\\Admin\\AppData\\Roaming\\Opera\\{40CA74AF-EBC4-4FAA-B21E-D13AB5B82111}\\Validator.exe"	37cb991688b505c3fe252f852ff4cfda.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

37cb991688b505c3fe252f852ff4cfda.exe

pid	process
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe
1140	37cb991688b505c3fe252f852ff4cfda.exe

C:\Users\Admin\AppData\Local\Temp\37cb991688b505c3fe252f852ff4cfda.exe
"C:\Users\Admin\AppData\Local\Temp\37cb991688b505c3fe252f852ff4cfda.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1140

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-1-0x00000000001B0000-0x00000000001C4000-memory.dmp

Filesize
80KB

Download
memory/1140-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1140-2-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1140-29-0x00000000002A0000-0x00000000002AD000-memory.dmp

Filesize
52KB

Download
memory/1140-38-0x00000000002A0000-0x00000000002AD000-memory.dmp

Filesize
52KB

Download
memory/1140-19-0x0000000000270000-0x0000000000294000-memory.dmp

Filesize
144KB

Download
memory/1140-42-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads