629ecc3eccffb1d6c72738229c7dd3c4c1424da7aeb61d7a13dc2fefc6af44ac

General

Target

4 UCBUG޸V6.8.exe
Size

1.5MB
MD5

13ae03e4845151ceba718274a7bab03f
SHA1

8c5b7e2e7066e0ac68244065bdd6ea53f636c38a
SHA256

08278b1881c2790a18f864544c42c337de7e579ea4ae121813a034d2578c9e64
SHA512

2149f0c4dad83f2b68acc27e8e19a2412cdaf80302e58f6920b317c5e5be78a42179225133590149825d0fceaf046106a69199a749d5e656120aebfc2dd9d6d5
SSDEEP

24576:WFJpsTRsnVspg8MFYH6UvoxFxMk1b6xTMdL2kHsh8lBYrxCmJ:WSBExb6xI1RHsKBYtR

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/700-73-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-81-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-79-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-77-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-75-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-85-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-84-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-83-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-71-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-68-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-66-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-64-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-62-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-60-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-58-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-56-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-53-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-51-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-49-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-47-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-45-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-38-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-37-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-43-0x0000000003550000-0x000000000358D000-memory.dmp	upx
behavioral4/memory/700-42-0x0000000003550000-0x000000000358D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4 UCBUG޸V6.8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
700	4 UCBUG޸V6.8.exe
700	4 UCBUG޸V6.8.exe
700	4 UCBUG޸V6.8.exe
700	4 UCBUG޸V6.8.exe
700	4 UCBUG޸V6.8.exe

C:\Users\Admin\AppData\Local\Temp\4 UCBUG޸V6.8.exe
"C:\Users\Admin\AppData\Local\Temp\4 UCBUG޸V6.8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e57cceb.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57ccec.tmp

Filesize
1.6MB

MD5
5870ea0d6ba8dd6e2008466bdd00e0f4

SHA1
d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5

SHA256
5a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d

SHA512
0c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57cced.tmp

Filesize
137KB

MD5
f6b847a54cfb804a25b8842b45fd1d50

SHA1
bb22fef07ce1577c8a7fa057d8cf05502c013bfc

SHA256
5dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583

SHA512
dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a

Download Submit
memory/700-73-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-81-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-79-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-77-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-75-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-85-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-84-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-83-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-71-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-68-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-66-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-64-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-62-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-60-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-58-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-56-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-53-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-51-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-49-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-47-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-45-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-38-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-37-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-43-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download
memory/700-42-0x0000000003550000-0x000000000358D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing