649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e

General

Target

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
Size

1.9MB
MD5

8305c45696b7e6763ff343ca024682d1
SHA1

b645f3fe56ac86ffde7d0e72ef48cd3eb4f48220
SHA256

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e
SHA512

0140f7b9f17ef4491e901eae2b6d882975e679594e1d208fc13e19bc88670b274f7b36f79f94a0f03baf1413c87aeb5cf42687d41ae4b85f9c98b7c38f54474a
SSDEEP

49152:WlsJPNJLt1TzK2m8Q2AajccD1RTsTmeC2yHL+Hq:WOJPNJDm8Q2Q4Tf2Y6

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2788-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-12-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-29-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

description	pid	process	target process
PID 2784 set thread context of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

pid	process
2788	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
2788	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
2788	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

description	pid	process	target process
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 2784 wrote to memory of 2788	2784	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
"C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2784

C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
"C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.4MB

MD5
71ac77addcdf12cc01f58c395988a6f0

SHA1
51036487a286025fd91b0bdc5f91d6ef357319e8

SHA256
0c2c827ae153454e8250c93f3a4352160d437ffeab13adf533a1d448cd9811ce

SHA512
13ba6073c248a369e28c28ab1f813e502fc5d14aabf81169ff37673dbf9c2537f477f525109f63ffa7b3dd7cc00c9ab22527082b7cc2cdd08b26c2d2e3a97529

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
8.0MB

MD5
98769e47a8dc3052f80c63af4a85346d

SHA1
350c0ce679eb9c248b00458b8fb31430600ba339

SHA256
a4732fd4665911e90033667450bc1e5f3ab59baf5f096cb0ac12620ac5d16ace

SHA512
6261dc4492caed1981df9e2e4a8dfb4292160146fb5fde8dfc8ffba81bdb30e1e66b98f1016e756c1dc401e0e6d1c8b31d1c208850ee1fee72ebe8ec8d6109d3

Download Submit
memory/2784-0-0x0000000001F70000-0x0000000002128000-memory.dmp

Filesize
1.7MB

Download
memory/2784-1-0x0000000001F70000-0x0000000002128000-memory.dmp

Filesize
1.7MB

Download
memory/2784-5-0x0000000002130000-0x00000000022E7000-memory.dmp

Filesize
1.7MB

Download
memory/2784-6-0x0000000001F70000-0x0000000002128000-memory.dmp

Filesize
1.7MB

Download
memory/2788-19-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2788-12-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-29-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads