f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d

General

Target

f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe
Size

1.1MB
MD5

de7b35d0710c5e7c743c0d4544439098
SHA1

cdaf1abecd7f7d1691d24412859e0e32f85cf0bb
SHA256

f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d
SHA512

3b2ea89b77f323ea239febbf16f1fa076a9e8dd7cc876a3ba9644c6dba5a93afcb4cd94f75b486d43f1dfb3edfc86c89d73ba677f45b2525d972d4c4e4b15bea
SSDEEP

24576:sGWnO3BWAdKMBO0M/1qRyr8PwMIiaeX/TiH6G2:suBu1qIgyl6T

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1100-43-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-45-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-47-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-46-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-41-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-39-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-37-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-35-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-33-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-31-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-29-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-25-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-23-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-19-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-17-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-15-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-13-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-11-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-9-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-0-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1100-27-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yckhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe"	f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe

pid	process
1100	f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe
1100	f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe
1100	f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe

C:\Users\Admin\AppData\Local\Temp\f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe
"C:\Users\Admin\AppData\Local\Temp\f64677355d803435e97ec7257009db9a8fc92d22d71e0f828f1300fec5a9434d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-43-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-45-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-47-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-46-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-41-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-39-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-37-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-35-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-33-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-31-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-29-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-25-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-23-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-19-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-48-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download
memory/1100-17-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-15-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-13-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-11-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-9-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1100-27-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads