ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82

General

Target

ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe
Size

1.5MB
MD5

2df7ed39134067ead21d54da2cb623cf
SHA1

1e36d1b9f33a0171f8c422ea9a1e31bcb1fc4e76
SHA256

ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82
SHA512

bf1af6fad717b3f82cbb2a1ed756dfb4c075fc05fe694bebe78c5a6ec74d2b8d5ca6c6634b3c6b22336031b6e2a0155fb1a945e47a0a1e1f7a16d562a8199001
SSDEEP

24576:386VRfhNl9aIERmyROpWcaZWiXn1A0c0MmAG6dAkQ8eBYrs7Az:smRhNUmywbaZWwn+0c0EHGh8eBYF

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/956-1-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-34-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-28-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-4-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-3-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-32-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-47-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-46-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-45-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-42-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-38-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-30-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-26-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-24-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-18-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-14-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-10-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-40-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-2-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-22-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-21-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-16-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-12-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-8-0x0000000002980000-0x00000000029BD000-memory.dmp	upx
behavioral2/memory/956-6-0x0000000002980000-0x00000000029BD000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
956	ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe
956	ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe
956	ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe

C:\Users\Admin\AppData\Local\Temp\ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe
"C:\Users\Admin\AppData\Local\Temp\ea0ad656fc34598fc631eaf3860305172f1d38d1b1c90cd5e027c0836fc6bd82.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-1-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-34-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-28-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-4-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-3-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-32-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-47-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-46-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-45-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-42-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-38-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-30-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-26-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-24-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-18-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-14-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-10-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-40-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-2-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-22-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-21-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-16-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-12-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-8-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download
memory/956-6-0x0000000002980000-0x00000000029BD000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing