c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e

General

Target

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
Size

11.4MB
MD5

6b8be8350765348dd1752b0a0f8243f4
SHA1

155aa6ebaf9d86231854faf1162a0e9b0320c9a7
SHA256

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e
SHA512

f3f437f53b69b172a71f8377fd196c2badf151de1496fd88b7976296141c5e2c0c983e85b70ca05a635d2024b168cba9fab149e74ab3dec525aa3b31db3452c2
SSDEEP

196608:8Fl5poKEGK54nLHXD4oOVqMBfOo6eU7iayz+r83k8EzBnMpAf2FaqKM:8rTEy3cVqMdaiayZkBzBiAeFaDM

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2556-25-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/2556-29-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/2556-27-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/2556-30-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/2556-34-0x0000000000400000-0x0000000000F23040-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

description	ioc	process
File opened (read-only)	\??\H:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\N:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\U:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\V:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\O:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\P:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\W:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\Z:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\G:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\I:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\K:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\M:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\J:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\L:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\Q:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\X:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\Y:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\E:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\R:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\S:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
File opened (read-only)	\??\T:	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

description pid process

Token: SeDebugPrivilege 2556 c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

description	pid	process
Token: SeDebugPrivilege	2556	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

pid	process
3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

description	pid	process	target process
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
PID 3032 wrote to memory of 2556	3032	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe	c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe

C:\Users\Admin\AppData\Local\Temp\c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
"C:\Users\Admin\AppData\Local\Temp\c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
C:\Users\Admin\AppData\Local\Temp\c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e.exe
2⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2556

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\luls.pk
Filesize
4.4MB

MD5
e85716eb2fb2587c45b46c4aaac5636b

SHA1
43cb8934ce5aa275f0644533030f2f5db24b57ab

SHA256
421147720f4897db9fbd9216f62f7e2bcc7c4c8c0eb89e0c274a71b149606d15

SHA512
04d4002fc8664396499df79b7de785dc62e3362e03cfdef9bef9c0179ffd382d7d1815d2555d214a4d544d3b8643594be8076a893c12857a8a3465fc6ca36098

Download Submit
C:\Users\Admin\AppData\Local\Temp\temps.temp
Filesize
3.5MB

MD5
142a46a7585fc54b4ac46c43a0645bd2

SHA1
ff64ba0726cdd038f57b84a18e656640106b7887

SHA256
5ac74c3b17ba519f9f59355aa854b529f6c046bee53859dbbf8a60d772827101

SHA512
1275c9f0b7c2b2f35a915b4347625550bce0526d3e43134a9b97f7ae4b0e4de70d0415301d988c6a1440d39ef2baeaaf0741b613b5ca599255598d0ae6e4341a

Download Submit
memory/2556-27-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/2556-15-0x00000000001D0000-0x00000000002EA000-memory.dmp

Filesize
1.1MB

Download
memory/2556-12-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2556-7-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2556-36-0x000000000046D000-0x000000000046E000-memory.dmp

Filesize
4KB

Download
memory/2556-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2556-23-0x000000000046D000-0x000000000046E000-memory.dmp

Filesize
4KB

Download
memory/2556-34-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/2556-30-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/2556-31-0x0000000000912000-0x0000000000F24000-memory.dmp

Filesize
6.1MB

Download
memory/2556-25-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/2556-13-0x00000000001D0000-0x00000000002EA000-memory.dmp

Filesize
1.1MB

Download
memory/2556-29-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/2556-28-0x0000000000912000-0x0000000000F24000-memory.dmp

Filesize
6.1MB

Download
memory/3032-0-0x0000000000400000-0x0000000001D74000-memory.dmp

Filesize
25.5MB

Download
memory/3032-1-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/3032-18-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/3032-20-0x0000000000400000-0x0000000001D74000-memory.dmp

Filesize
25.5MB

Download
memory/3032-21-0x0000000003750000-0x00000000037BD000-memory.dmp

Filesize
436KB

Download
memory/3032-22-0x0000000006310000-0x0000000007C84000-memory.dmp

Filesize
25.5MB

Download
memory/3032-6-0x0000000003750000-0x00000000037BD000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads