71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a

General

Target

71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a.exe
Size

1.8MB
MD5

a32d872008ce42b58a4ee5b14033da97
SHA1

39956bb7bdf0444f5baa444d8703b3b9621e886c
SHA256

71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a
SHA512

8adec2af4c1b199a28257df6e4d005497639e953eb35adfafb9c767b5dd0f56652c1007ebdbfb3c96b063c3f439c98ff62436342bbe8e1c7b2fc791e9797834d
SSDEEP

49152:5Kp5IlgZEM6uUdANyth4/DCUrM8NZ27/Poh:Qpn7vigDHg8n0oh

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2756-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2756-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2756-0-0x0000000000400000-0x0000000000829000-memory.dmp	vmprotect
behavioral1/memory/2756-1-0x0000000000400000-0x0000000000829000-memory.dmp	vmprotect
behavioral1/memory/2756-32-0x0000000000400000-0x0000000000829000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2756	71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2756	71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a.exe
2756	71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a.exe
2756	71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a.exe

C:\Users\Admin\AppData\Local\Temp\71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a.exe
"C:\Users\Admin\AppData\Local\Temp\71b6336b0f5eac3fe962c1910146f8bc9a93e6fc0e775bee74399199b32b574a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x0000000000400000-0x0000000000829000-memory.dmp

Filesize
4.2MB

Download
memory/2756-1-0x0000000000400000-0x0000000000829000-memory.dmp

Filesize
4.2MB

Download
memory/2756-2-0x0000000077C80000-0x0000000077C81000-memory.dmp

Filesize
4KB

Download
memory/2756-4-0x0000000077C80000-0x0000000077C81000-memory.dmp

Filesize
4KB

Download
memory/2756-8-0x0000000075780000-0x0000000075781000-memory.dmp

Filesize
4KB

Download
memory/2756-12-0x0000000075780000-0x0000000075781000-memory.dmp

Filesize
4KB

Download
memory/2756-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-32-0x0000000000400000-0x0000000000829000-memory.dmp

Filesize
4.2MB

Download
memory/2756-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-62-0x0000000077C80000-0x0000000077C81000-memory.dmp

Filesize
4KB

Download
memory/2756-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2756-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing