55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849

General

Target

55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
Size

88KB
MD5

3b47dbab8b41ccc785f7e06e19eb2908
SHA1

3c023ffbf16c24f5725f6fd63a5cc24f8decbf23
SHA256

55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849
SHA512

2d7273d301856774716de14d228c13abd96d96174e5879503f9347c8b63165c51790c710bd1d0d8af9803b58ce36307bea4228e3e530d1babd74cf216c79751d
SSDEEP

1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1548-7-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/1548-9-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/1548-10-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/1548-52-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/2884-82-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exe

pid process

3636 explorer.exe
2884 explorer.exe
3792 explorer.exe
4612 explorer.exe

pid	process
3636	explorer.exe
2884	explorer.exe
3792	explorer.exe
4612	explorer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1548-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1548-9-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1548-10-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1548-52-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2884-82-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Video Driver = "C:\\Users\\Admin\\AppData\\Roaming\\config\\explorer.exe"	reg.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 5068 set thread context of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 3636 set thread context of 2884	3636	explorer.exe	explorer.exe
PID 3636 set thread context of 3792	3636	explorer.exe	explorer.exe
PID 3792 set thread context of 4612	3792	explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

explorer.exe

description	pid	process
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe
Token: SeDebugPrivilege	2884	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exeexplorer.exeexplorer.exe

pid	process
5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
1548	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
3636	explorer.exe
2884	explorer.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.execmd.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 5068 wrote to memory of 1548	5068	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
PID 1548 wrote to memory of 4568	1548	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	cmd.exe
PID 1548 wrote to memory of 4568	1548	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	cmd.exe
PID 1548 wrote to memory of 4568	1548	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	cmd.exe
PID 4568 wrote to memory of 1596	4568	cmd.exe	reg.exe
PID 4568 wrote to memory of 1596	4568	cmd.exe	reg.exe
PID 4568 wrote to memory of 1596	4568	cmd.exe	reg.exe
PID 1548 wrote to memory of 3636	1548	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	explorer.exe
PID 1548 wrote to memory of 3636	1548	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	explorer.exe
PID 1548 wrote to memory of 3636	1548	55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 2884	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 3792	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 3792	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 3792	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 3792	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 3792	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 3792	3636	explorer.exe	explorer.exe
PID 3636 wrote to memory of 3792	3636	explorer.exe	explorer.exe
PID 3792 wrote to memory of 4612	3792	explorer.exe	explorer.exe
PID 3792 wrote to memory of 4612	3792	explorer.exe	explorer.exe
PID 3792 wrote to memory of 4612	3792	explorer.exe	explorer.exe
PID 3792 wrote to memory of 4612	3792	explorer.exe	explorer.exe
PID 3792 wrote to memory of 4612	3792	explorer.exe	explorer.exe
PID 3792 wrote to memory of 4612	3792	explorer.exe	explorer.exe
PID 3792 wrote to memory of 4612	3792	explorer.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
"C:\Users\Admin\AppData\Local\Temp\55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe
  "C:\Users\Admin\AppData\Local\Temp\55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JRISO.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Video Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\config\explorer.exe" /f
      4⤵
      Adds Run key to start application
      PID:1596
- - C:\Users\Admin\AppData\Roaming\config\explorer.exe
    "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Roaming\config\explorer.exe
      "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2884
  - - C:\Users\Admin\AppData\Roaming\config\explorer.exe
      "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Users\Admin\AppData\Roaming\config\explorer.exe
        
        "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\cxz.exe

Filesize
294B

MD5
724b51e367e52be864f1c467e00adf9e

SHA1
f9d000d0575daf08e57c8f7ee70b3d186c812a97

SHA256
0005c3af14befe8bb1a595143f1191556732dc55d4fa1f4eaa8eac85d1059238

SHA512
419e1a3892fad275ee5c0cc1a7a7644037a00a852e70140540c8806e19cdc72063e6c2decb76da38404b4f57813a57ac2a1ffb99ed130a750d418f5f2ec0822f

Download Submit
C:\Users\Admin\AppData\Local\Temp\JRISO.txt

Filesize
149B

MD5
fc1798b7c7938454220fda837a76f354

SHA1
b232912930b2bc24ff18bf7ecd58f872bbe01ea0

SHA256
7f0a5917b5aca9c5beb153aad0ef95bf0aeafb83768da5b086c3f029ba42d7c8

SHA512
d1abdd45a8e5d33893b9d19424174a07feed145d2e6b4be318ab5fde503f850579a4a101a010f30e16ecde2c7123f45357a8341214655321ee0f0097ca911331

Download Submit
C:\Users\Admin\AppData\Roaming\config\explorer.exe

Filesize
88KB

MD5
f72714135110b2857186b6b83f81910b

SHA1
1177fce92ac254595cf91b9f8996f02949d23ac8

SHA256
f01a2c2fc495eb1c74b75e83583160b2b95ccc189bf6abc749423b0c0fb8d7ac

SHA512
9af1a6b25b9f73006793638e1f00b26e86869c4c359158a18cc7aa0e19e86bcb8e9bc9a7e57edbcb9233d8542c646389acd06d39a0d1998fda81c1e0233ca422

Download Submit
memory/1548-52-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1548-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1548-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1548-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2884-82-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3636-45-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3792-55-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3792-43-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3792-39-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3792-47-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3792-46-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4612-53-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4612-58-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4612-80-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/5068-6-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/5068-2-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/5068-4-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/5068-5-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/5068-3-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads