3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a

General

Target

3cd4736e078626a00f2c36d6e5f09a1c.exe
Size

556KB
MD5

3cd4736e078626a00f2c36d6e5f09a1c
SHA1

f7fddc294a13c78d12730dd1f4ee8c49055d1379
SHA256

3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a
SHA512

e80e12af806220aed99a0dfa17d76ed35f05f174fe9e9b3ce5500fb80b0fa3379e507af133e644cf122397e1c83b76535d010ce7bfe005fb810dd66528e23e3e
SSDEEP

12288:07Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:07L1yMgcnOds44Fp2PWUDI8

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3380-53-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/3380-56-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/2344-59-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3140-63-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2064-68-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2064-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2064-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3140-67-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2344-64-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2064-62-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3140-58-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2344-57-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2344-52-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3380-49-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	31.193.3.240
Destination IP	31.193.3.240

Program crash 1 IoCs

pid	pid_target	Process
3176	912	WerFault.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1232	tasklist.exe
1864	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
976	3cd4736e078626a00f2c36d6e5f09a1c.exe

C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe
"C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:976
- C:\Users\Admin\NB4wr66jY4.exe
  C:\Users\Admin\NB4wr66jY4.exe
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe
    3⤵
    PID:2488
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1232
- - C:\Users\Admin\biiew.exe
    "C:\Users\Admin\biiew.exe"
    3⤵
    PID:4092
- C:\Users\Admin\3xek.exe
  C:\Users\Admin\3xek.exe
  2⤵
  PID:4608
- - C:\Users\Admin\AppData\Local\798294ad\X
    *0*bc*4e809dd8*31.193.3.240:53
    3⤵
    PID:2956
- C:\Users\Admin\2xek.exe
  C:\Users\Admin\2xek.exe
  2⤵
  PID:396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del 3cd4736e078626a00f2c36d6e5f09a1c.exe
  2⤵
  PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 80
1⤵
- Program crash
PID:3176

C:\Users\Admin\2xek.exe
"C:\Users\Admin\2xek.exe"
1⤵
PID:2064

C:\Users\Admin\2xek.exe
"C:\Users\Admin\2xek.exe"
1⤵
PID:3140

C:\Users\Admin\2xek.exe
"C:\Users\Admin\2xek.exe"
1⤵
PID:2344

C:\Users\Admin\2xek.exe
"C:\Users\Admin\2xek.exe"
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 912 -ip 912
1⤵
PID:1636

C:\Users\Admin\2xek.exe
"C:\Users\Admin\2xek.exe"
1⤵
PID:912

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\NB4wr66jY4.exe

Filesize
94KB

MD5
eb290c307670d7c14ad917ba640fe0e0

SHA1
d17751b25fb749c691715409efd3a4bcc517a896

SHA256
12365f9a85a25a59e8c9f855b40e88559cb5239141d5db6394befcaadfdb6830

SHA512
0864597cc0f9ef66db090370803f5bebe041a43cf527470e0612ce4e278dab25d9e5db1c98d81748b87c852d21bf7bf9f3f7176795b33091beffe2726306b7aa

Download Submit
C:\Users\Admin\biiew.exe

Filesize
94KB

MD5
3619ceed09f67f1ce5460e0911448c09

SHA1
d74881611205f0a90052851a46b0de7aaf36e414

SHA256
a1d327d4d175d92425dca894a45c71e730b0c47cc5f3b2590db5c198196dde45

SHA512
2efc433e1dce82995814ce4bedc931a709a0f0da2e007fdc4ab7b85b423bc20946fca915697acf071ebb2cc43f84f6786fd52c8fe77fa5d145be00f8c442682e

Download Submit
memory/2064-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2064-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2064-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2064-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2344-57-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2344-64-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2344-91-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2344-59-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2344-52-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3140-63-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3140-67-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3140-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3140-92-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3380-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3380-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3380-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3380-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3408-88-0x0000000002540000-0x0000000002548000-memory.dmp

Filesize
32KB

Download
memory/4608-89-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/4608-81-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/4608-82-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing