ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50

General

Target

ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe
Size

11.8MB
MD5

f21afad74e5fef3c9171e8be9e0274fb
SHA1

51cf93e0a26d094bbcb052511d1df018fb2efd15
SHA256

ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50
SHA512

1ad1412e6cd977c54635179c366bc63e5200328f0d5876b2f4ef2572f2b31e44fbc0f3281d4036fe2eeecaaac816da04199d3e2d0b463618d5aafbd6bd948f9c
SSDEEP

196608:0Blv8nKkJVuSsJV00StotNO8VKcSCr9D68RZ4/NeCHJ3OxXa8Rj//9UZKJVsVW7+:0v8nFHsE0StotNO8VKcSCr9D68RZ4/Nx

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4960-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4960-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe
4960	ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe

C:\Users\Admin\AppData\Local\Temp\ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe
"C:\Users\Admin\AppData\Local\Temp\ecaabcabe8d2aff8c9d34db257dadad11d6c12a870be0b505b045a1f0bd93b50.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4960-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4960-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing