Analysis
-
max time kernel
11s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 12:14
Static task
static1
Behavioral task
behavioral1
Sample
5509fe49ec28dc7abb5aae78a88b606e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
5509fe49ec28dc7abb5aae78a88b606e.exe
Resource
win10v20201028
General
-
Target
5509fe49ec28dc7abb5aae78a88b606e.exe
-
Size
2.6MB
-
MD5
1b2484bfb1a25d55d201207a15cf266b
-
SHA1
70119d1800e6d39cbe0e5160f8acc2bdb2e46c7d
-
SHA256
3f531ce5eae08958610dbac073a881654f1efad802ca3d5a325a75355e460da0
-
SHA512
49db1d4577617e61c1a583fb82858d47f1d36ff348bf2229a848c8fcf7b3ee6d0c151e723a4527b2b822e943d3a235e428324bf60c61fcde69900da850596a26
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
uiomucymnd.exeuiomucymnd.tmppid process 3668 uiomucymnd.exe 2160 uiomucymnd.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 10 IoCs
Processes:
uiomucymnd.tmpdescription ioc process File opened for modification C:\Program Files (x86)\WIFIInspector\EGL.dll uiomucymnd.tmp File created C:\Program Files (x86)\WIFIInspector\unins000.dat uiomucymnd.tmp File created C:\Program Files (x86)\WIFIInspector\is-TGO60.tmp uiomucymnd.tmp File created C:\Program Files (x86)\WIFIInspector\is-IHCM6.tmp uiomucymnd.tmp File created C:\Program Files (x86)\WIFIInspector\is-8BEGC.tmp uiomucymnd.tmp File created C:\Program Files (x86)\WIFIInspector\is-DH81J.tmp uiomucymnd.tmp File opened for modification C:\Program Files (x86)\WIFIInspector\unins000.dat uiomucymnd.tmp File opened for modification C:\Program Files (x86)\WIFIInspector\WIFIInspector.exe uiomucymnd.tmp File created C:\Program Files (x86)\WIFIInspector\is-541AQ.tmp uiomucymnd.tmp File created C:\Program Files (x86)\WIFIInspector\is-5N9AQ.tmp uiomucymnd.tmp -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5509fe49ec28dc7abb5aae78a88b606e.exeuiomucymnd.tmppid process 1020 5509fe49ec28dc7abb5aae78a88b606e.exe 1020 5509fe49ec28dc7abb5aae78a88b606e.exe 1020 5509fe49ec28dc7abb5aae78a88b606e.exe 1020 5509fe49ec28dc7abb5aae78a88b606e.exe 2160 uiomucymnd.tmp 2160 uiomucymnd.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
uiomucymnd.tmppid process 2160 uiomucymnd.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5509fe49ec28dc7abb5aae78a88b606e.execmd.exeuiomucymnd.exedescription pid process target process PID 1020 wrote to memory of 3076 1020 5509fe49ec28dc7abb5aae78a88b606e.exe cmd.exe PID 1020 wrote to memory of 3076 1020 5509fe49ec28dc7abb5aae78a88b606e.exe cmd.exe PID 1020 wrote to memory of 3076 1020 5509fe49ec28dc7abb5aae78a88b606e.exe cmd.exe PID 3076 wrote to memory of 3668 3076 cmd.exe uiomucymnd.exe PID 3076 wrote to memory of 3668 3076 cmd.exe uiomucymnd.exe PID 3076 wrote to memory of 3668 3076 cmd.exe uiomucymnd.exe PID 3668 wrote to memory of 2160 3668 uiomucymnd.exe uiomucymnd.tmp PID 3668 wrote to memory of 2160 3668 uiomucymnd.exe uiomucymnd.tmp PID 3668 wrote to memory of 2160 3668 uiomucymnd.exe uiomucymnd.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\5509fe49ec28dc7abb5aae78a88b606e.exe"C:\Users\Admin\AppData\Local\Temp\5509fe49ec28dc7abb5aae78a88b606e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\uiomucymnd.exe" /VERYSILENT2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uiomucymnd.exe"C:\Users\Admin\AppData\Local\Temp\uiomucymnd.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9NFUF.tmp\uiomucymnd.tmp"C:\Users\Admin\AppData\Local\Temp\is-9NFUF.tmp\uiomucymnd.tmp" /SL5="$40112,90766,54272,C:\Users\Admin\AppData\Local\Temp\uiomucymnd.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-9NFUF.tmp\uiomucymnd.tmpMD5
f8b110dc2063d3b29502aa7042d26122
SHA11a0fd3db79eadc1ce714f6267d476ddbec0f5e79
SHA256e8730b0bf8f94cbb8babbfefb32cef8e8d19ec823f28c33a7d48c78589710762
SHA512f3125d3f575aff68105ebb3eadbce30547d34e12237d8ebbc555c6fe12bcc0a5ea85a38e26f2900d70af70ec07efde3b8cd65dc0fdada637496531245ea5052f
-
C:\Users\Admin\AppData\Local\Temp\is-9NFUF.tmp\uiomucymnd.tmpMD5
f8b110dc2063d3b29502aa7042d26122
SHA11a0fd3db79eadc1ce714f6267d476ddbec0f5e79
SHA256e8730b0bf8f94cbb8babbfefb32cef8e8d19ec823f28c33a7d48c78589710762
SHA512f3125d3f575aff68105ebb3eadbce30547d34e12237d8ebbc555c6fe12bcc0a5ea85a38e26f2900d70af70ec07efde3b8cd65dc0fdada637496531245ea5052f
-
C:\Users\Admin\AppData\Local\Temp\uiomucymnd.exeMD5
8f49472ed2ec6b48b3e17200e35a6cc2
SHA12cd6519d99614e7f6450d4e24fc9b5796dd78233
SHA2567b9c5ed5f1c101fd42c207025ce61311bb8c6c49037a574a66352c3c21f7ba0d
SHA5123fdda6ca38b83edc7bc77f3d6f63ae953b33ee38b870a5dbab72da2867767211352cb5d15076c073b9b8546b3844b3b180876537f78f2385d0160b3091bb57f9
-
C:\Users\Admin\AppData\Local\Temp\uiomucymnd.exeMD5
8f49472ed2ec6b48b3e17200e35a6cc2
SHA12cd6519d99614e7f6450d4e24fc9b5796dd78233
SHA2567b9c5ed5f1c101fd42c207025ce61311bb8c6c49037a574a66352c3c21f7ba0d
SHA5123fdda6ca38b83edc7bc77f3d6f63ae953b33ee38b870a5dbab72da2867767211352cb5d15076c073b9b8546b3844b3b180876537f78f2385d0160b3091bb57f9
-
memory/1020-0-0x0000000010000000-0x0000000010274000-memory.dmpFilesize
2.5MB
-
memory/2160-6-0x0000000000000000-mapping.dmp
-
memory/3076-1-0x0000000000000000-mapping.dmp
-
memory/3668-2-0x0000000000000000-mapping.dmp
-
memory/3668-3-0x0000000000000000-mapping.dmp