3a4bf798231612317c21b8aff89764b1b2af99d50d9711b2427f6b12ded6f1c1

General

Target

70bd69aabdbbefe092446c67be0944e5.exe
Size

450KB
MD5

70bd69aabdbbefe092446c67be0944e5
SHA1

3f1924415ca9d1f5bbac7cdfee898e1d2baf567a
SHA256

3a4bf798231612317c21b8aff89764b1b2af99d50d9711b2427f6b12ded6f1c1
SHA512

1e033a6cde07c7639574d95576da6460023047c709952ff2abc7e88779dceac16111d209ae482b3c5d36a2e698c0adcd48b115b0f16216add1bacbd8fa1ed527
SSDEEP

12288:tcH5B8B3YDg7cSVF2djYwiYIFmyLJoSWMOx:tcH5yBoMgSVVyIrLl

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4424-0-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/4076-3-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/4076-5-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/4424-6-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/4076-8-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/4076-14-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3040-18-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3040-19-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3040-22-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3040-23-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3040-24-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3040-26-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winset.ini	70bd69aabdbbefe092446c67be0944e5.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4424 set thread context of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4076 set thread context of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 3972 set thread context of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4424	70bd69aabdbbefe092446c67be0944e5.exe
4076	70bd69aabdbbefe092446c67be0944e5.exe
3972	70bd69aabdbbefe092446c67be0944e5.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4424 wrote to memory of 4076	4424	70bd69aabdbbefe092446c67be0944e5.exe	88
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 4076 wrote to memory of 3972	4076	70bd69aabdbbefe092446c67be0944e5.exe	93
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94
PID 3972 wrote to memory of 3040	3972	70bd69aabdbbefe092446c67be0944e5.exe	94

C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe
"C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe
  C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe
    C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe
      "C:\Users\Admin\AppData\Local\Temp\70bd69aabdbbefe092446c67be0944e5.exe"
      4⤵
      Drops file in System32 directory
      PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-19-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3040-26-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3040-24-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3040-23-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3040-22-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3040-18-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3972-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3972-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3972-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4076-14-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4076-8-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4076-5-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4076-3-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4424-0-0x0000000000400000-0x0000000000590000-memory.dmp

Filesize
1.6MB

Download
memory/4424-6-0x0000000000400000-0x0000000000590000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing