2f433fdf0f20b555252790b661605446d0f3a89b477e8846b23af25226d6e1cf

General

Target

cd724fa2e817bd44098e64f38ee68ca7.exe
Size

553KB
MD5

cd724fa2e817bd44098e64f38ee68ca7
SHA1

b8394b3f05d66c3799506b1e8416a9a7b8fea581
SHA256

2f433fdf0f20b555252790b661605446d0f3a89b477e8846b23af25226d6e1cf
SHA512

40fce683e83ac80ccc7b92925842c2dfd4f9f25da14c3fca6bc5c46d3e6deca684009caa81dbfe62c47d9623787c4636e4836f807f97fcaa1cbbdecf06df4501
SSDEEP

12288:whCqB8577W8YlCqrd16OCEUfq6+wJFHLv4OM6MALm035:whC+8Z7ulCebSZq6+AFHr4z6Myme

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3248-0-0x0000000000400000-0x00000000006A9000-memory.dmp	upx
behavioral2/memory/528-3-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/528-5-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/528-6-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3248-9-0x0000000000400000-0x00000000006A9000-memory.dmp	upx
behavioral2/memory/528-15-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3248 set thread context of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 set thread context of 0	3248	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 528 set thread context of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4720	cd724fa2e817bd44098e64f38ee68ca7.exe
4720	cd724fa2e817bd44098e64f38ee68ca7.exe
4720	cd724fa2e817bd44098e64f38ee68ca7.exe
4720	cd724fa2e817bd44098e64f38ee68ca7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3248	cd724fa2e817bd44098e64f38ee68ca7.exe
528	cd724fa2e817bd44098e64f38ee68ca7.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 528	3248	cd724fa2e817bd44098e64f38ee68ca7.exe	92
PID 3248 wrote to memory of 0	3248	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 3248 wrote to memory of 0	3248	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 3248 wrote to memory of 0	3248	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 3248 wrote to memory of 0	3248	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 3248 wrote to memory of 0	3248	cd724fa2e817bd44098e64f38ee68ca7.exe
PID 528 wrote to memory of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93
PID 528 wrote to memory of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93
PID 528 wrote to memory of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93
PID 528 wrote to memory of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93
PID 528 wrote to memory of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93
PID 528 wrote to memory of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93
PID 528 wrote to memory of 4720	528	cd724fa2e817bd44098e64f38ee68ca7.exe	93
PID 4720 wrote to memory of 3516	4720	cd724fa2e817bd44098e64f38ee68ca7.exe	57
PID 4720 wrote to memory of 3516	4720	cd724fa2e817bd44098e64f38ee68ca7.exe	57
PID 4720 wrote to memory of 3516	4720	cd724fa2e817bd44098e64f38ee68ca7.exe	57
PID 4720 wrote to memory of 3516	4720	cd724fa2e817bd44098e64f38ee68ca7.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3516
- C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe
  "C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe
    "C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:528
  - - C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe
      "C:\Users\Admin\AppData\Local\Temp\cd724fa2e817bd44098e64f38ee68ca7.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-13-0x0000000000670000-0x0000000000739000-memory.dmp

Filesize
804KB

Download
memory/528-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/528-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/528-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/528-15-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3248-9-0x0000000000400000-0x00000000006A9000-memory.dmp

Filesize
2.7MB

Download
memory/3248-0-0x0000000000400000-0x00000000006A9000-memory.dmp

Filesize
2.7MB

Download
memory/3516-18-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3516-19-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4720-12-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4720-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4720-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4720-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4720-17-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4720-23-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4720-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing