edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0

General

Target

edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0.exe
Size

544KB
MD5

6daa549d22e7895dbac3ed902fe2a94b
SHA1

4647fe610b9c712f883ebbf86c56bd00999ed70c
SHA256

edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0
SHA512

ce2ae184c408cbee42623fd6084a1d85165988961e7ebddbc48da9bc80c20406a5737c638834a73c096b5807f7efc7c0967195fbe464f7f7875319efa04ba0aa
SSDEEP

12288:RZVYQdDqoeqfDFsRvPBl9RkVsdhdkp4wM+ZdTkdnrMTgW:RZVYg7eqf8Pj9RgpfdTOMz

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1216	MpSigStub.exe
1216	MpSigStub.exe
1216	MpSigStub.exe
1216	MpSigStub.exe
1216	MpSigStub.exe
1216	MpSigStub.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe
File created	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1216	1700	edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0.exe	27
PID 1700 wrote to memory of 1216	1700	edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0.exe	27
PID 1700 wrote to memory of 1216	1700	edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0.exe	27

C:\Users\Admin\AppData\Local\Temp\edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0.exe
"C:\Users\Admin\AppData\Local\Temp\edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\MpSigStub.exe
  MpSigStub.exe /program "C:\Users\Admin\AppData\Local\Temp\edfb5c9135b2dffef5eb58c5a42b3c59c115ce64150643c1bb9298f740c612e0.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\08BD003FB6ACD5F4FA3E4745EEE3250B-Sigs\1.163.1497.0_TO_1.163.1506.0_MPASDLTA.VDM._P

Filesize
4KB

MD5
8fae28c6fc3167110d92e7fe799e1d66

SHA1
3275b82e44f858e88dbc21b3ba5ce972b8b1ac7a

SHA256
c8e9be26bc54df1d26d08c195e04fd4810e8604c8da182a3af1aa4506187c15c

SHA512
6a07c478e8f5c11d8f82363bccfb1e77f480e2ace917f4496d0af2563206fd6e28ef2eae12ceb8222aeb66b161734ff109a4f4c4f50b03f72769cb739b4f6726

Download Submit
C:\Windows\Temp\08BD003FB6ACD5F4FA3E4745EEE3250B-Sigs\1.163.1497.0_TO_1.163.1506.0_MPAVDLTA.VDM._P

Filesize
16KB

MD5
890682db275f127a006841afc66d2eef

SHA1
0f466ce6899cf56f745b547d6ca99d3c70829369

SHA256
6c894d45d26d5344d0f0d63d3f54bd81f99a2a4399133be77d2af865ddf08970

SHA512
bca776ec231fe4352ee08ad1a73758b147cf77f0d9b7f4d62a73bfd636bd9e89061fe91ff145fa440ba70c2ea53a428fa0398609161f1b9f67db83179df72c69

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm

Filesize
11.1MB

MD5
b17051cea6ecf263ef7eb4b79fa50763

SHA1
ad15f2f519b32ffce10e23e6ee6436b0d49136e0

SHA256
f10a3dbeaba655f7f595c8954cb85d5e7804a2cdcf6a09c0544eeb739d442dfa

SHA512
f904c88765b9dea30a2276ac988dbc7daa2ca19c879983ab03fa4c7665eec987644ec8734711b7d02597e3b4af8b2625a54930f7afb5ad095c966bef3c087475

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm

Filesize
11.1MB

MD5
b17051cea6ecf263ef7eb4b79fa50763

SHA1
ad15f2f519b32ffce10e23e6ee6436b0d49136e0

SHA256
f10a3dbeaba655f7f595c8954cb85d5e7804a2cdcf6a09c0544eeb739d442dfa

SHA512
f904c88765b9dea30a2276ac988dbc7daa2ca19c879983ab03fa4c7665eec987644ec8734711b7d02597e3b4af8b2625a54930f7afb5ad095c966bef3c087475

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm

Filesize
331KB

MD5
f0f8b583c084699ddbf036b892058f6e

SHA1
3d7b233ea117b55b3708d29fda451d39313ff27a

SHA256
d2ca676148c1f59c2d3494bb0aa28127d2957ea8c2f494ddebe7e1249038e9a1

SHA512
383a8cdf759e7b4395e0e295700db316c8d06c8589333f22ddc29efdf350c66f5fd8b729f95a0e2a1b3a0798f8af0b06a9bb4971a300039d9baea6101d233697

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm

Filesize
331KB

MD5
f0f8b583c084699ddbf036b892058f6e

SHA1
3d7b233ea117b55b3708d29fda451d39313ff27a

SHA256
d2ca676148c1f59c2d3494bb0aa28127d2957ea8c2f494ddebe7e1249038e9a1

SHA512
383a8cdf759e7b4395e0e295700db316c8d06c8589333f22ddc29efdf350c66f5fd8b729f95a0e2a1b3a0798f8af0b06a9bb4971a300039d9baea6101d233697

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpengine.dll

Filesize
7.8MB

MD5
97bdc9a400eef273cc4b336614ca74bd

SHA1
b0c55c5f48ec0f32bcac631005755c722913e21c

SHA256
2b0792816c882c8b7dafe93e8148df94b1c0786287272e3fe4005166751069ae

SHA512
7dbe3c6b11ed5997d78bc4982f5b485ad61cc779add961899922a62df8b010dd3481a6236d631c9557816e84de8e4b16d8b66362b04ec6becb16fe85b8169e86

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpengine.dll

Filesize
7.8MB

MD5
97bdc9a400eef273cc4b336614ca74bd

SHA1
b0c55c5f48ec0f32bcac631005755c722913e21c

SHA256
2b0792816c882c8b7dafe93e8148df94b1c0786287272e3fe4005166751069ae

SHA512
7dbe3c6b11ed5997d78bc4982f5b485ad61cc779add961899922a62df8b010dd3481a6236d631c9557816e84de8e4b16d8b66362b04ec6becb16fe85b8169e86

Download Submit
memory/1700-55-0x0000000140000000-0x00000001401D0000-memory.dmp

Filesize
1.8MB

Download
memory/1700-64-0x0000000140000000-0x00000001401D0000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads