Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-05-2022 23:59
Static task
static1
Behavioral task
behavioral1
Sample
automm.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
automm.exe
Resource
win10v2004-20220414-en
General
-
Target
automm.exe
-
Size
13.7MB
-
MD5
1efada31f6471b9832659d8555d8b26a
-
SHA1
a3b6624728d9fb0b9aa11a84a9caddcce36685e8
-
SHA256
951bb4716f2bf3e434a8fdf9a86491a0f6403c570153f52c3c7df051e4874ffd
-
SHA512
596e48cc0cb87830f5dc6047c45415765bb342d668ff019372d45fefc1520fde78f1e5f8169914316de18c0bf582a75716a0517e59e181ec1e0ed7d57469f5dd
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
automm.exepid process 1892 automm.exe 1892 automm.exe 1892 automm.exe 1892 automm.exe 1892 automm.exe 1892 automm.exe 1892 automm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
automm.exedescription pid process target process PID 388 wrote to memory of 1892 388 automm.exe automm.exe PID 388 wrote to memory of 1892 388 automm.exe automm.exe PID 388 wrote to memory of 1892 388 automm.exe automm.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-file-l1-2-0.dllFilesize
18KB
MD549c3ffd47257dbcb67a6be9ee112ba7f
SHA104669214375b25e2dc8a3635484e6eeb206bc4eb
SHA256322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165
SHA512bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98
-
C:\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-file-l2-1-0.dllFilesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
C:\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-localization-l1-2-0.dllFilesize
20KB
MD5588bd2a8e0152e0918742c1a69038f1d
SHA19874398548891f6a08fc06437996f84eb7495783
SHA256a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094
SHA51232ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f
-
C:\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-processthreads-l1-1-1.dllFilesize
18KB
MD5d699333637db92d319661286df7cc39e
SHA10bffb9ed366853e7019452644d26e8e8f236241b
SHA256fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504
SHA5126fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51
-
C:\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-timezone-l1-1-0.dllFilesize
18KB
MD5f62b66f451f2daa8410ad62d453fa0a2
SHA14bf13db65943e708690d6256d7ddd421cc1cc72b
SHA25648eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720
SHA512d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419
-
C:\Users\Admin\AppData\Local\Temp\_MEI3882\python39.dllFilesize
4.3MB
MD5088904a7f5b53107db42e15827e3af98
SHA11768e7fb1685410e188f663f5b259710f597e543
SHA2563761c232e151e9ceaf6c7d37b68da3df1962e3106e425cc3937d1f60170f3718
SHA512c5edc25fd9a37673f769af1a1fd540b41e68351bc30b44bc83a1d0d4a8fb078888bbb31173a77ef47698631c9816bc05637b499c20d63e3d65457d9aa4bc2c6b
-
C:\Users\Admin\AppData\Local\Temp\_MEI3882\ucrtbase.dllFilesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
-
\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-file-l1-2-0.dllFilesize
18KB
MD549c3ffd47257dbcb67a6be9ee112ba7f
SHA104669214375b25e2dc8a3635484e6eeb206bc4eb
SHA256322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165
SHA512bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98
-
\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-file-l2-1-0.dllFilesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-localization-l1-2-0.dllFilesize
20KB
MD5588bd2a8e0152e0918742c1a69038f1d
SHA19874398548891f6a08fc06437996f84eb7495783
SHA256a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094
SHA51232ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f
-
\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-processthreads-l1-1-1.dllFilesize
18KB
MD5d699333637db92d319661286df7cc39e
SHA10bffb9ed366853e7019452644d26e8e8f236241b
SHA256fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504
SHA5126fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51
-
\Users\Admin\AppData\Local\Temp\_MEI3882\api-ms-win-core-timezone-l1-1-0.dllFilesize
18KB
MD5f62b66f451f2daa8410ad62d453fa0a2
SHA14bf13db65943e708690d6256d7ddd421cc1cc72b
SHA25648eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720
SHA512d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419
-
\Users\Admin\AppData\Local\Temp\_MEI3882\python39.dllFilesize
4.3MB
MD5088904a7f5b53107db42e15827e3af98
SHA11768e7fb1685410e188f663f5b259710f597e543
SHA2563761c232e151e9ceaf6c7d37b68da3df1962e3106e425cc3937d1f60170f3718
SHA512c5edc25fd9a37673f769af1a1fd540b41e68351bc30b44bc83a1d0d4a8fb078888bbb31173a77ef47698631c9816bc05637b499c20d63e3d65457d9aa4bc2c6b
-
\Users\Admin\AppData\Local\Temp\_MEI3882\ucrtbase.dllFilesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
-
memory/1892-54-0x0000000000000000-mapping.dmp
-
memory/1892-69-0x000007FEFC5C1000-0x000007FEFC5C3000-memory.dmpFilesize
8KB