01fe6afddde790315aa9606e798c597b395041e61413edeab5edd6399e5224a7

General

Target

05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe
Size

2.9MB
MD5

ed44c98c40576ef50f6abcf6e40c71d7
SHA1

3fa4d2232ebaef519eb388cae03a329123410113
SHA256

05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1
SHA512

c66dd4cbf1b4743e455a70f65ffa4fba0a95926767c1a1c03fe9bfba52cc364c2f609bf5b65c786213718a139dd5b2ff40f7cf8a60d8e2663347c0168c9a72ed
SSDEEP

49152:svW87wGcsoYjRaCX0n1oi5owJXHorpRUrpFucvsmFY59tAHBaCKz4Z:s+87t1Vln0l5TJXINGNloxCKz4Z

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-0-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-4-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2692-3-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-5-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-6-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-7-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-8-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-9-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-12-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-13-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-14-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-15-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-16-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-17-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-18-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-19-0x0000000000E20000-0x000000000160D000-memory.dmp	upx
behavioral1/memory/2080-20-0x0000000000E20000-0x000000000160D000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe
2080	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	whoami.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2080	2692	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	31
PID 2692 wrote to memory of 2080	2692	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	31
PID 2692 wrote to memory of 2080	2692	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	31
PID 2692 wrote to memory of 2080	2692	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	31
PID 2080 wrote to memory of 624	2080	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	33
PID 2080 wrote to memory of 624	2080	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	33
PID 2080 wrote to memory of 624	2080	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	33
PID 2080 wrote to memory of 624	2080	05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	33

C:\Users\Admin\AppData\Local\Temp\05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe
"C:\Users\Admin\AppData\Local\Temp\05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe
  C:\Users\Admin\AppData\Local\Temp\05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe --foreground
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-9-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-16-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-12-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-13-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-5-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-6-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-7-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-8-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-20-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-19-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-18-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-14-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-15-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-4-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2080-17-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2692-2-0x0000000033840000-0x000000003402D000-memory.dmp

Filesize
7.9MB

Download
memory/2692-3-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download
memory/2692-0-0x0000000000E20000-0x000000000160D000-memory.dmp

Filesize
7.9MB

Download

Analysis

Sharing