92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b

General

Target

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Size

1.8MB
MD5

f41c9e6ca239395e71bcf027987282dc
SHA1

560a973e308f20e0dbe64a38eaeaa22285ced049
SHA256

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b
SHA512

cbf99c0e43b3a314ee6681f8655a269c0d51e4d40c10ea9c8571be30c5d69c0287c57be5b13e4fa7aecad7095efb4a741f1839dc9089251f41fa96f35011764a
SSDEEP

24576:h7OEqlRKCYqoxOMto8enhtiQkbx6zWXXfKfzZn00Eze2aP4sjagjotkEz4RaZMjM:h7B50L7fiQ26zEXfId0vFaQgMh4pj

Score

7^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/4696-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-28-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4696-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service
T1102

Processes:

flow ioc

536 discord.com
715 discord.com
1284 pastebin.com
1291 pastebin.com
1560 discord.com
357 discord.com
363 discord.com

flow	ioc
536	discord.com
715	discord.com
1284	pastebin.com
1291	pastebin.com
1560	discord.com
357	discord.com
363	discord.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	pid	process	target process
PID 1400 set thread context of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

14764 4696 WerFault.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

pid	pid_target	process	target process
14764	4696	WerFault.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

pid	process
4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	pid	process	target process
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1400 wrote to memory of 4696	1400	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 4696 wrote to memory of 14764	4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	WerFault.exe
PID 4696 wrote to memory of 14764	4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	WerFault.exe
PID 4696 wrote to memory of 14764	4696	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 33344
3⤵
- Program crash
PID:14764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.6MB

MD5
f6830fcf6326c3f2f06bc27cd853799b

SHA1
1d7e3413e3821bbbbdb4c71246b5d58c26da8efb

SHA256
52c4b2d620a115c96d3e3b390f7d0a19695cff31e5f522c6a1bcff554c0a016a

SHA512
6ad3ce744073ba77902a5d4a4a762d0e335d99a7e602e24a5c7941c8f421fe92ba13a0cc7e81300dcec0179cc919d4fc72e993823ce4e066d2d96a6496822c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
5.7MB

MD5
d199678ad7dd29fea2d6dfc9c93d6a0b

SHA1
cfd6ffa72355e5e3861514c0d48e131f3cfe735f

SHA256
50ceb070275258f327902f51d9d49dbb0fdd162d04b3958bc9c450f55a0dcbd3

SHA512
69ada71a42c390407afa255f4d4519fdfd0bf5c6f630e57865f05ca9780308f9f64661b286a23b985b07fa22a607a4133b1b4415692c7208cb841d85616cccaf

Download Submit
memory/1400-1-0x0000000003F70000-0x0000000004137000-memory.dmp

Filesize
1.8MB

Download
memory/1400-2-0x0000000004140000-0x00000000042F7000-memory.dmp

Filesize
1.7MB

Download
memory/4696-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-19-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-28-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4696-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads