614dc90f7840bac5ddef81b1a5ab89c26eb84002d3cf3e9819d5f67ecdc66a49

General

Target

52e9715f85ce22acc9f512e8e5343b10.exe
Size

206KB
MD5

52e9715f85ce22acc9f512e8e5343b10
SHA1

fa0560b4be58b9e84c57649fe2b571b062c23060
SHA256

614dc90f7840bac5ddef81b1a5ab89c26eb84002d3cf3e9819d5f67ecdc66a49
SHA512

8c92c747e0d43ee3b9b7eeb303ac8f0f348d530b5d3853eeeb7e633bb68d4df2d128ead1e43fe304a96edba3b3e2ea289d30b636fc2e1381296af9c862cf457c
SSDEEP

3072:6gd8Vkdpn6ySznrDWpyrCCzrhThkwOYUpWqX9ogCl+ZVij+an7OSS9iIsLc3:Hd8VmpGXDWOXVThkvY8NrCl+biC9iIs

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

1548 explorer.exe
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

340 csrss.exe

pid	process
1548	explorer.exe

pid	process
340	csrss.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

52e9715f85ce22acc9f512e8e5343b10.exe

description pid process target process

PID 3056 set thread context of 1548 3056 52e9715f85ce22acc9f512e8e5343b10.exe explorer.exe

description	pid	process	target process
PID 3056 set thread context of 1548	3056	52e9715f85ce22acc9f512e8e5343b10.exe	explorer.exe

Modifies registry class 3 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\registry\machine\Software\Classes\Interface\{bfa737fc-a273-1bb3-d4a0-adf310963e7d}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{bfa737fc-a273-1bb3-d4a0-adf310963e7d}\u = "71"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{bfa737fc-a273-1bb3-d4a0-adf310963e7d}\cid = "1459825570189416678"	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

explorer.exe

pid process

1548 explorer.exe
1548 explorer.exe
1548 explorer.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 1548 explorer.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

csrss.exe

pid process

340 csrss.exe

pid	process
1548	explorer.exe
1548	explorer.exe
1548	explorer.exe

description	pid	process
Token: SeDebugPrivilege	1548	explorer.exe

pid	process
340	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

52e9715f85ce22acc9f512e8e5343b10.exeexplorer.execsrss.exe

description	pid	process	target process
PID 3056 wrote to memory of 1548	3056	52e9715f85ce22acc9f512e8e5343b10.exe	explorer.exe
PID 3056 wrote to memory of 1548	3056	52e9715f85ce22acc9f512e8e5343b10.exe	explorer.exe
PID 3056 wrote to memory of 1548	3056	52e9715f85ce22acc9f512e8e5343b10.exe	explorer.exe
PID 3056 wrote to memory of 1548	3056	52e9715f85ce22acc9f512e8e5343b10.exe	explorer.exe
PID 3056 wrote to memory of 1548	3056	52e9715f85ce22acc9f512e8e5343b10.exe	explorer.exe
PID 1548 wrote to memory of 340	1548	explorer.exe	csrss.exe
PID 340 wrote to memory of 2160	340	csrss.exe	WMIADAP.EXE
PID 340 wrote to memory of 2160	340	csrss.exe	WMIADAP.EXE
PID 340 wrote to memory of 2608	340	csrss.exe	wmiprvse.exe
PID 340 wrote to memory of 2608	340	csrss.exe	wmiprvse.exe

C:\Users\Admin\AppData\Local\Temp\52e9715f85ce22acc9f512e8e5343b10.exe
"C:\Users\Admin\AppData\Local\Temp\52e9715f85ce22acc9f512e8e5343b10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\explorer.exe
00000098*
2⤵
- Deletes itself
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2160

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\consrv.dll
Filesize
31KB

MD5
adf1ddd89d424e8d0e275cc42747ec81

SHA1
321105503846b4a5f8fd3ccd6d92253c39b3e1ce

SHA256
5611fddc5046fce5bbd4d1c1779df429a217b1f952ec973059f7c67e4dfdd46f

SHA512
3afb78bc1e49c224726ae824a4d36923bc9fedbdbc027576427932d900bbb17a3b536f1b384bc52bd1a1892ff23c5a2453065530fbdc0023392a0d17e7cbc184

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
Filesize
2KB

MD5
9fd598c4e837feb35c9493c65fd9aa6a

SHA1
e0534b6dd0a9c4863e8e8871cd405ce32e036263

SHA256
0df06c0373100e4193ff70cf93da3d6fcbaa8e6ae104d73daa6a5b99fedf31d8

SHA512
b51a8e54626387d60d007cd636b31d730ad7fd58b344a68c1c802bf249b1966087e0aec539127be5fa74b1a69c31de96197fcb952a3a86e700cc408e71002374

Download Submit
memory/340-19-0x0000000002550000-0x000000000255C000-memory.dmp

Filesize
48KB

Download
memory/340-20-0x0000000002550000-0x000000000255C000-memory.dmp

Filesize
48KB

Download
memory/1548-3-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/1548-4-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download
memory/1548-9-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/1548-14-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/3056-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3056-1-0x0000000000230000-0x0000000000249000-memory.dmp

Filesize
100KB

Download
memory/3056-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads