2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a

General

Target

2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
Size

8.6MB
MD5

6d2e7519efafe2c03657d3cbe8f3793f
SHA1

8e55e284cc10c07c969ad71d878e35c1081ff13f
SHA256

2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a
SHA512

1780f09735dfec15c9322ee1836eb5fbb858035d98c709fef56a1d5f96000e46b0c94050f88d6f454f2ced01648fe981a2a67646636ffe3fbfedb76006e2532c
SSDEEP

98304:J8bAz4y9gQfS2Kqn4CnLEslfYexusOK8gyo4q8PUSkCdyn21PlrdaXX:aNegQ2G4CnLE27ue8Fo4q89k21PO

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1724	aria2c.exe

Loads dropped DLL 3 IoCs

pid	Process
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2636	Process not Found

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2424-12-0x00000000033E0000-0x0000000003477000-memory.dmp	upx
behavioral1/memory/2424-14-0x00000000033E0000-0x0000000003477000-memory.dmp	upx
behavioral1/memory/2424-36-0x00000000033E0000-0x0000000003477000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1724	2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe	28
PID 2424 wrote to memory of 1724	2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe	28
PID 2424 wrote to memory of 1724	2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe	28
PID 2424 wrote to memory of 1724	2424	2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe	28

C:\Users\Admin\AppData\Local\Temp\2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe
"C:\Users\Admin\AppData\Local\Temp\2ae73b6db376002f878024e913b4466b1f4fdaace07f09c4b879408055e8a09a.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\aria2c.exe
  --check-certificate=false --disable-ipv6=true --enable-rpc=true --quiet=true --rpc-allow-origin-all=true --rpc-listen-all=true --rpc-listen-port=7111 --rpc-secret=DOWNLOAD --stop-with-process=2424 --dir="C:\Users\Admin\AppData\Local\Temp\down" --continue=true --max-tries=0 --max-connection-per-server=15 --min-split-size=5M --split=10 --max-concurrent-downloads=5 --file-allocation=falloc
  2⤵
  - Executes dropped EXE
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\aria2c.exe

Filesize
5.3MB

MD5
53d237cbbdac5ae3dc65c9ee8a51094d

SHA1
b2aa5c6150f556f3fa6f6904ac57befc07a14b6d

SHA256
2646c5d3eb8b0fc57e85f30434cef3d3a261d01f065fc4ad23f020c31f1dd6bd

SHA512
7a29d0fbcca4402c32756ccdf8b8c79a36512d005f695d8eb9b8c88412a57d916e581ae58c55451cf6210cd76d6bdc166121492b1b653719d30a4758a7c3a5cb

Download Submit
memory/1724-34-0x0000000001010000-0x0000000001570000-memory.dmp

Filesize
5.4MB

Download
memory/2424-28-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-12-0x00000000033E0000-0x0000000003477000-memory.dmp

Filesize
604KB

Download
memory/2424-14-0x00000000033E0000-0x0000000003477000-memory.dmp

Filesize
604KB

Download
memory/2424-16-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-20-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-19-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-22-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-23-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-24-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-27-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-0-0x0000000010000000-0x000000001010A000-memory.dmp

Filesize
1.0MB

Download
memory/2424-26-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-15-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-18-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-25-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-17-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-29-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-32-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-31-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-33-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-30-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-21-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-36-0x00000000033E0000-0x0000000003477000-memory.dmp

Filesize
604KB

Download
memory/2424-37-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download
memory/2424-44-0x00000000035A0000-0x000000000360B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing