188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d

General

Target

188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
Size

536KB
MD5

9166ab4af3b73058b50e386f208a1872
SHA1

4acb2d8174aa42d8fe98bae46b4fe1da9115b1d9
SHA256

188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d
SHA512

5933bcff2bd677cd230ada15e6de34eab929792735b3801161f1ea0b78ef19ecce052625dadeb7188668b053ba6cc2ed6b1ca25a2605683ee891d374a6633da6
SSDEEP

12288:ahf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:adQyDL9xp/BGA1RkmOkx2LF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2728-0-0x0000000000060000-0x0000000000162000-memory.dmp	upx
behavioral1/memory/2728-77-0x0000000000060000-0x0000000000162000-memory.dmp	upx
behavioral1/memory/2728-270-0x0000000000060000-0x0000000000162000-memory.dmp	upx
behavioral1/memory/2728-440-0x0000000000060000-0x0000000000162000-memory.dmp	upx
behavioral1/memory/2728-696-0x0000000000060000-0x0000000000162000-memory.dmp	upx
behavioral1/memory/2728-699-0x0000000000060000-0x0000000000162000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	114.114.114.114
Destination IP	223.5.5.5
Destination IP	114.114.114.114

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2eb450	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
Token: SeTcbPrivilege	2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
Token: SeDebugPrivilege	2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
Token: SeDebugPrivilege	1212	Explorer.EXE
Token: SeTcbPrivilege	1212	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1212	2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe	19
PID 2728 wrote to memory of 1212	2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe	19
PID 2728 wrote to memory of 1212	2728	188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe	19

C:\Users\Admin\AppData\Local\Temp\188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe
"C:\Users\Admin\AppData\Local\Temp\188271cb9e6c5b966bcc3bbd9b203d0fe0285f73076eb800e1fd62f234b4110d.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a1d01a31bd8a4884ee2c1121eca6afb

SHA1
fff2f0287f943ac260d452061e52d1884d91ac6d

SHA256
2be1243c1eb228ba37f051bc149aa72479c50f2b51cfd261a97d41dd33e91f3d

SHA512
b2573f9c9f9dd8c4f8b3582e53d57032b57e72dc07712b1941fac1b3f309d3222d73bcd61961b58949e372505c9f50b6e76d82a37d2d6e90413f46db86a9c473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8abe114993772d0f2d6b5fc00531c201

SHA1
22f4ff0759a2a30ecc7123892aa7a8b89213bbb7

SHA256
903cd49716ea54a988b5ca79ea08db9c8d0435de961e67051353fcfa33d316f2

SHA512
92623a8a18313b81f81ea5ab413fec3ff04b18f0a50f4acc08a053686c8c17b24ba240238934ed45d2c851da5fcf7371c3cc89068c036317fe751f88aef44c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC7C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC9E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1212-4-0x0000000002A80000-0x0000000002A83000-memory.dmp

Filesize
12KB

Download
memory/1212-5-0x0000000003C80000-0x0000000003CF9000-memory.dmp

Filesize
484KB

Download
memory/1212-188-0x0000000003C80000-0x0000000003CF9000-memory.dmp

Filesize
484KB

Download
memory/1212-6-0x0000000002A80000-0x0000000002A83000-memory.dmp

Filesize
12KB

Download
memory/1212-3-0x0000000002A80000-0x0000000002A83000-memory.dmp

Filesize
12KB

Download
memory/2728-0-0x0000000000060000-0x0000000000162000-memory.dmp

Filesize
1.0MB

Download
memory/2728-77-0x0000000000060000-0x0000000000162000-memory.dmp

Filesize
1.0MB

Download
memory/2728-270-0x0000000000060000-0x0000000000162000-memory.dmp

Filesize
1.0MB

Download
memory/2728-440-0x0000000000060000-0x0000000000162000-memory.dmp

Filesize
1.0MB

Download
memory/2728-696-0x0000000000060000-0x0000000000162000-memory.dmp

Filesize
1.0MB

Download
memory/2728-699-0x0000000000060000-0x0000000000162000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing