87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7

General

Target

87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
Size

536KB
MD5

227e604b34be886177d7ec8599e9d5c2
SHA1

520ff16aa7a9c7d19a0509bf1ec353632354afe5
SHA256

87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7
SHA512

624898a25e6c35a796a0bf8bdb7861837a8c88a74786d7d8c90f24fe8311366e0e33fd67cecae0f1e9075ef4d40f062666dfbaf0626e30b361029bb025177dff
SSDEEP

12288:Whf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:WdQyDL9xp/BGA1RkmOkx2LF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1640-0-0x0000000000360000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1640-149-0x0000000000360000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1640-335-0x0000000000360000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1640-621-0x0000000000360000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1640-721-0x0000000000360000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1640-733-0x0000000000360000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1640-747-0x0000000000360000-0x0000000000462000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	223.5.5.5

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\1c13d0	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
Token: SeTcbPrivilege	1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
Token: SeDebugPrivilege	1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
Token: SeDebugPrivilege	1268	Explorer.EXE
Token: SeTcbPrivilege	1268	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1268	1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe	16
PID 1640 wrote to memory of 1268	1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe	16
PID 1640 wrote to memory of 1268	1640	87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1268
- C:\Users\Admin\AppData\Local\Temp\87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe
  "C:\Users\Admin\AppData\Local\Temp\87d9dbe6855fec46fea89b0b9675309b060f38b69bc8e2fc888604362bdcd7a7.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ed77fc41d85ff3151830e08c231533

SHA1
92c79a3de0d54aa074335701354acd91e47c2ab8

SHA256
00fa0e3f3fd191200b77ad8b241e9e2c24f854dcc7b448ff79ce856611aa9ef7

SHA512
f0db3050840af0bc744d08bef427dc8112ae1da104c169aa30687da4f6f8dbd49121564c55de5e244a1f72cfdf88e88ba9bf0791f98f2d7f7557b9951d30220c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
189a9d8c52ebdab37ebdc7755b58d35a

SHA1
869d62aa10b0c2b8bd2fa66ae968a125c18a45e2

SHA256
50d41865431c3ae52691e975ae92a0f10f04be9e036f9908883a8c5fcb63a772

SHA512
50e26740fa2d84203b08582d18db66c461b6281935ea0cb5924bbd100893a8a270d07ca3137529170be9a91b9c1d8cc7bd8dee6faec405a4b66bb9cba3565f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2057d31bce0d4a2d67517b2355ffd617

SHA1
fe42be3d8cf51285832f65158b5fd9752b3cd777

SHA256
9e9a27b685142af8e08833b7724cc3957b619e4e844b98e91c67d6731d605465

SHA512
2dde4582bd25a1c0145d7c50009ef1af86e1c838aab8c5a4e58ec7b8615d608ff6b454c65838a0a45a0ea6db7ae10441b97afdf29b6cb567f43b3de260c51177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee7f75e3b38bec20d5568d9023f7ebfe

SHA1
c58729aeaf97791065272b51107937c146a12030

SHA256
64a411ae2a4b674ff77196559c659cbb1d1ea5765c6b9e9790ea04d713c39648

SHA512
2596118bc150a79a9205510408a56c2a493cd1e106858748c7e1ec3d2d3e990bef42b354812ee4e7b699ebd695d5c22320435112ce777daaf2286d49c8a4eddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd0af88a77783ca31ad0330acfe2c7cc

SHA1
bf3ccbcae2cc89072d7ab619a5872cf1e384728a

SHA256
a5e859d8bfb0c9c0b5a8d40435a028e2b7d47768d4088a4ce2341a172e177ab8

SHA512
1ddf8fdfd03b96a90ac5bd89b70fbc2750de8673e28428b876e5ecb94b2c2f28ec5e8688a5bbc955bebc2336eb3c4b9a14c22012053f415816377a275fd25d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7283.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72D4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1268-6-0x0000000003E50000-0x0000000003EC9000-memory.dmp

Filesize
484KB

Download
memory/1268-259-0x0000000003E50000-0x0000000003EC9000-memory.dmp

Filesize
484KB

Download
memory/1268-5-0x0000000002960000-0x0000000002963000-memory.dmp

Filesize
12KB

Download
memory/1268-4-0x0000000003E50000-0x0000000003EC9000-memory.dmp

Filesize
484KB

Download
memory/1268-3-0x0000000002960000-0x0000000002963000-memory.dmp

Filesize
12KB

Download
memory/1640-149-0x0000000000360000-0x0000000000462000-memory.dmp

Filesize
1.0MB

Download
memory/1640-335-0x0000000000360000-0x0000000000462000-memory.dmp

Filesize
1.0MB

Download
memory/1640-0-0x0000000000360000-0x0000000000462000-memory.dmp

Filesize
1.0MB

Download
memory/1640-621-0x0000000000360000-0x0000000000462000-memory.dmp

Filesize
1.0MB

Download
memory/1640-721-0x0000000000360000-0x0000000000462000-memory.dmp

Filesize
1.0MB

Download
memory/1640-733-0x0000000000360000-0x0000000000462000-memory.dmp

Filesize
1.0MB

Download
memory/1640-747-0x0000000000360000-0x0000000000462000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing