2f433fdf0f20b555252790b661605446d0f3a89b477e8846b23af25226d6e1cf

General

Target

cd724fa2e817bd44098e64f38ee68ca7.exe
Size

553KB
MD5

cd724fa2e817bd44098e64f38ee68ca7
SHA1

b8394b3f05d66c3799506b1e8416a9a7b8fea581
SHA256

2f433fdf0f20b555252790b661605446d0f3a89b477e8846b23af25226d6e1cf
SHA512

40fce683e83ac80ccc7b92925842c2dfd4f9f25da14c3fca6bc5c46d3e6deca684009caa81dbfe62c47d9623787c4636e4836f807f97fcaa1cbbdecf06df4501
SSDEEP

12288:whCqB8577W8YlCqrd16OCEUfq6+wJFHLv4OM6MALm035:whC+8Z7ulCebSZq6+AFHr4z6Myme

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000400000-0x00000000006A9000-memory.dmp	upx
behavioral1/memory/2704-3-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2704-5-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2704-6-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/1720-9-0x0000000000400000-0x00000000006A9000-memory.dmp	upx
behavioral1/memory/2704-15-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 set thread context of 0	1720	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 2704 set thread context of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1976	cd724fa2e817bd44098e64f38ee68ca7.exe
1976	cd724fa2e817bd44098e64f38ee68ca7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1720	cd724fa2e817bd44098e64f38ee68ca7.exe
2704	cd724fa2e817bd44098e64f38ee68ca7.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 2704	1720	cd724fa2e817bd44098e64f38ee68ca7.exe	28
PID 1720 wrote to memory of 0	1720	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 1720 wrote to memory of 0	1720	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 1720 wrote to memory of 0	1720	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 1720 wrote to memory of 0	1720	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 1720 wrote to memory of 0	1720	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 2704 wrote to memory of 1976	2704	cd724fa2e817bd44098e64f38ee68ca7.exe	29
PID 1976 wrote to memory of 1196	1976	cd724fa2e817bd44098e64f38ee68ca7.exe	21
PID 1976 wrote to memory of 1196	1976	cd724fa2e817bd44098e64f38ee68ca7.exe	21
PID 1976 wrote to memory of 1196	1976	cd724fa2e817bd44098e64f38ee68ca7.exe	21
PID 1976 wrote to memory of 1196	1976	cd724fa2e817bd44098e64f38ee68ca7.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe
  "C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe
    "C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe
      "C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-21-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1196-17-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1720-9-0x0000000000400000-0x00000000006A9000-memory.dmp

Filesize
2.7MB

Download
memory/1720-0-0x0000000000400000-0x00000000006A9000-memory.dmp

Filesize
2.7MB

Download
memory/1976-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1976-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1976-12-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1976-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1976-20-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1976-31-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2704-15-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2704-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2704-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2704-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing