9e086065e72958392bc3c2a9b4c13e914427dcecf01a585a73bd70d8f6852fdc

General

Target

9e086065e72958392bc3c2a9b4c13e914427dcecf01a585a73bd70d8f6852fdc.exe
Size

1.8MB
MD5

454b6aedc196d98df00ca1490f0052ec
SHA1

3ee3001d070a4aa9bf3ff412a323ce1ab45e9482
SHA256

9e086065e72958392bc3c2a9b4c13e914427dcecf01a585a73bd70d8f6852fdc
SHA512

4bc7a3aeda178267a72a942e93426ebd88b6a70d0a396889d18b4b1a275228f74ea7ec7ff93130e961bb3f80a132bf5b28c381cef4bd7f89d61dd735e46dac02
SSDEEP

49152:zAOnbN+fY+WDnI5bPmDyaxpQhRGbWI3sowcoCystlm4qto+:dQw+WDnI5euRGbv8odys32o+

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-0-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-70-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-71-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-72-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-74-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-75-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-76-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-77-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-78-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-79-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-80-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-81-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-82-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-83-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-84-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-85-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral1/memory/2972-86-0x0000000000400000-0x0000000000708000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2972	9e086065e72958392bc3c2a9b4c13e914427dcecf01a585a73bd70d8f6852fdc.exe

C:\Users\Admin\AppData\Local\Temp\9e086065e72958392bc3c2a9b4c13e914427dcecf01a585a73bd70d8f6852fdc.exe
"C:\Users\Admin\AppData\Local\Temp\9e086065e72958392bc3c2a9b4c13e914427dcecf01a585a73bd70d8f6852fdc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab1410.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1494.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit
memory/2972-76-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-77-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-70-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-71-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-72-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-73-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2972-74-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-75-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-0-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-4-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2972-78-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-79-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-80-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-81-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-82-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-83-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-84-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-85-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2972-86-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing