2854ef18b052f7b19e9ef1f006508e87f1ee3ed2592eef1aa9bb7d941852c3ca

General

Target

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
Size

1.9MB
MD5

456dad1f25fefa40f70c152a706316bc
SHA1

c741c8e32f1510c175c6d518401f3cf4d4f6d8da
SHA256

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412
SHA512

e51d7f476d0b92cef1d2bc012f9436aead835642381241ba6d2dd149251a3ccc09b28e0be160e1e8f62aa6da79b935a6016700e31605895042c1fe61b4ca876f
SSDEEP

49152:F/MBkUJZCcifDFu/6nEkqg1kka+dW0hWk9NQXNF+9uop3biUIgYcoP:FEBkmZofDFu/6nR6SW+woVBlR

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1468-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-2-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-23-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-22-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-24-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-25-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-30-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-33-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-36-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-108-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1468-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 3876 set thread context of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

pid	process
1468	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
1468	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
1468	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
1468	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
1468	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
1468	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3876 wrote to memory of 1468	3876	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
77KB

MD5
4ee1f86b2be0c1dcd022aa9598f3cc9f

SHA1
84e2dead416ce3e95a8c434b9cc55ab659b8adb8

SHA256
eed6858479efcebb1c8c9a4db84a6a6e627bbef028da3dc1788697a5cb266047

SHA512
9c1fc84bf292a52175a149cb05c6b615d7131d105ea595e10ffbb366e21c25aa42f9b45b4e191481513691c417155ed9f8fa537741c82028055fcac0fa3eefd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
99KB

MD5
fd1113ccfdf8a4e1f2a1d2dd6739f423

SHA1
4a55d626feee29b7859eba6d8bee5fb74a5a44f3

SHA256
ccf3eca40b97dfe688ee37e60e0b7aeb5cade2533f160beb0b316e637de3e4ac

SHA512
adaded78d03495d1dd831b7e148f8bd5a4fbde4038d98f3f053468436db81b03fd42ffe6bc760e7a544aa1a95aa13747f750b26fcd15b2cc66f45b1223029de4

Download Submit
memory/1468-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-2-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-23-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-22-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-24-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-25-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-30-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-33-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-36-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-108-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1468-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3876-1-0x0000000000890000-0x0000000000A58000-memory.dmp

Filesize
1.8MB

Download
memory/3876-3-0x0000000002400000-0x00000000025B7000-memory.dmp

Filesize
1.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads