649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e

General

Target

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
Size

1.9MB
MD5

8305c45696b7e6763ff343ca024682d1
SHA1

b645f3fe56ac86ffde7d0e72ef48cd3eb4f48220
SHA256

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e
SHA512

0140f7b9f17ef4491e901eae2b6d882975e679594e1d208fc13e19bc88670b274f7b36f79f94a0f03baf1413c87aeb5cf42687d41ae4b85f9c98b7c38f54474a
SSDEEP

49152:WlsJPNJLt1TzK2m8Q2AajccD1RTsTmeC2yHL+Hq:WOJPNJDm8Q2Q4Tf2Y6

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4580-2-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-22-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-32-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4580-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

description	pid	process	target process
PID 1648 set thread context of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

pid	process
4580	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
4580	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
4580	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
4580	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
4580	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
4580	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

description	pid	process	target process
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
PID 1648 wrote to memory of 4580	1648	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe

C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
"C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
"C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.4MB

MD5
71ac77addcdf12cc01f58c395988a6f0

SHA1
51036487a286025fd91b0bdc5f91d6ef357319e8

SHA256
0c2c827ae153454e8250c93f3a4352160d437ffeab13adf533a1d448cd9811ce

SHA512
13ba6073c248a369e28c28ab1f813e502fc5d14aabf81169ff37673dbf9c2537f477f525109f63ffa7b3dd7cc00c9ab22527082b7cc2cdd08b26c2d2e3a97529

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
10.3MB

MD5
e4f1b1b220eba773e384380d8d83d701

SHA1
994ccb392ab2cef542fde6cb96754e4de985e454

SHA256
9ecb242347d568bbc97dc20021229f6f2524810aa69e5169d40afde9549ee522

SHA512
5f1515017908677df48436e148f8fa12ec885ad576a1194fd2c7b7fda1ceccb8c93367702118483dc8f59669e431a86e923078de4f1f1434ea139c6a3f5f7ad7

Download Submit
memory/1648-3-0x0000000002460000-0x0000000002617000-memory.dmp

Filesize
1.7MB

Download
memory/1648-1-0x0000000002290000-0x0000000002454000-memory.dmp

Filesize
1.8MB

Download
memory/4580-32-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-22-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-2-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4580-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads