16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265

General

Target

16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
Size

536KB
MD5

759aac2d106f797f4ee6ac1dffb117f1
SHA1

f0abc1820ba698b33a431c03133a852be69881fe
SHA256

16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265
SHA512

3138e01ef92d7fa3275f24203f8d667ea5862529ed654b9f3473699b5841d528fb12d290e8ce1f68ebc4643a32befc242ea79edc324ce24497a567f240963f4d
SSDEEP

12288:Fhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:FdQyDL9xp/BGA1RkmOkx2LF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1640-0-0x0000000000370000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1640-69-0x0000000000370000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1640-264-0x0000000000370000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1640-486-0x0000000000370000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1640-658-0x0000000000370000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1640-663-0x0000000000370000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1640-675-0x0000000000370000-0x0000000000472000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	223.5.5.5

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\1c13d0	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
Token: SeTcbPrivilege	1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
Token: SeDebugPrivilege	1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
Token: SeDebugPrivilege	1272	Explorer.EXE
Token: SeTcbPrivilege	1272	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1272	1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe	13
PID 1640 wrote to memory of 1272	1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe	13
PID 1640 wrote to memory of 1272	1640	16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
- C:\Users\Admin\AppData\Local\Temp\16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
  "C:\Users\Admin\AppData\Local\Temp\16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d49062d7a1963bededff282e2688eff

SHA1
a71acef35e019399c6f62f25e2a7664da11e7237

SHA256
619b9c4fc84d84ceb62d3dc7db8f5402580d4c025c64bb5df92e63e65f670954

SHA512
f6cdd294d89c297cbf5a3e746927e99327b53f04f9fdc6f5d7a45628bfef7a74e4026bc217b192629c68b0f885175a4334096a7e2ff71d53d8b2ef680efd6fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e35137ade43f9169cb3549ee3946ccfd

SHA1
d72e1451d0d5c05ebebadb7d4c0fb7473c7bc4aa

SHA256
d24cf281884eab8d9e6af4bf524ecab880c6eb013901d49172f52f3e4eedb449

SHA512
111783ce111ae08eeb66453a96e6e365e52b77e13faa0dec33abec898a3882d729240ae676cf16953d58e6506a07c866d78cf7d6a019f10577e28668c7b1ee51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
323238544e7f465c9d6763e56e43db6b

SHA1
883f2ec3a8f3ee294e7f6e7aebf313e89de7618b

SHA256
c342c553014361cdae8335be69b69642eee518699545a6f5c82c85cb84c2a8ff

SHA512
4d5caafcf49b2a74307e9485cdc56b47658b75e038ffaf33445ea2b6b4760ca82c05009662ce4c33e0afcbe56b562df62592d2a8e1159d28c7e75d3be68e40a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bef3459a17b6092fb65b8e176e833a8

SHA1
a68e7501e2a6c0d614c46974a7c49f208bea6b8d

SHA256
343fd0dac80b44b33b0cb205fcf3ffc3d165b24f65756058a8d04d78911169f2

SHA512
1e968782c6757fcf7c62874df49b5e6466b5d814a9e7bf84e565d1d21406bb134da3b2d7e3236c67519351cde53892406aa5b36169dacd04efa375d754636ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC3F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCA0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1272-7-0x0000000002BC0000-0x0000000002C39000-memory.dmp

Filesize
484KB

Download
memory/1272-152-0x0000000002BC0000-0x0000000002C39000-memory.dmp

Filesize
484KB

Download
memory/1272-4-0x0000000002BC0000-0x0000000002C39000-memory.dmp

Filesize
484KB

Download
memory/1272-5-0x0000000002B20000-0x0000000002B23000-memory.dmp

Filesize
12KB

Download
memory/1272-3-0x0000000002B20000-0x0000000002B23000-memory.dmp

Filesize
12KB

Download
memory/1640-69-0x0000000000370000-0x0000000000472000-memory.dmp

Filesize
1.0MB

Download
memory/1640-0-0x0000000000370000-0x0000000000472000-memory.dmp

Filesize
1.0MB

Download
memory/1640-264-0x0000000000370000-0x0000000000472000-memory.dmp

Filesize
1.0MB

Download
memory/1640-486-0x0000000000370000-0x0000000000472000-memory.dmp

Filesize
1.0MB

Download
memory/1640-658-0x0000000000370000-0x0000000000472000-memory.dmp

Filesize
1.0MB

Download
memory/1640-663-0x0000000000370000-0x0000000000472000-memory.dmp

Filesize
1.0MB

Download
memory/1640-675-0x0000000000370000-0x0000000000472000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing