a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525

General

Target

a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe
Size

377KB
MD5

62a8898a2d1206fd41982fb73b35350e
SHA1

172f063f4a443095421d6b734ef074d69a62db52
SHA256

a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525
SHA512

f0f6763a6b46d24beb8def6bdeebfbd324da4dffff0ba9b0b02244752195659017dabb176cdceead5b8645c2ecc73fde5e7189734e183e6aa00b1242185d488b
SSDEEP

6144:zB8B4ev8CcOsW1D8fBUdEv8a6dRPMfbt4xb7s5evZTnVeb:zmmevXfsgofydHREfbSbfvZ2

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1920	omifsu.exe

Loads dropped DLL 2 IoCs

pid	Process
1628	a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe
1628	a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1920	omifsu.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1628	a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe
1920	omifsu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1920	1628	a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe	28
PID 1628 wrote to memory of 1920	1628	a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe	28
PID 1628 wrote to memory of 1920	1628	a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe	28
PID 1628 wrote to memory of 1920	1628	a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe	28

C:\Users\Admin\AppData\Local\Temp\a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe
"C:\Users\Admin\AppData\Local\Temp\a9a725ab156688e5dc7a30de715d15f6f5951cd6e1624dc8a0342dc04531d525.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4c180fe8.bat"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Roaming\Hyud\omifsu.exe
  "C:\Users\Admin\AppData\Roaming\Hyud\omifsu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4c180fe8.bat

Filesize
307B

MD5
d4a50308a95bfffbd1405758bae15aed

SHA1
93dcf497862bdab89ed91f79f991dd0f72f9b352

SHA256
10e7c7c4d78fce35a3902a73d9d2f43fe374b6a47a55e4ab72044c94d3d14e2d

SHA512
9ff16f1ed1ced38502527e08e079711294c0fd1e3b3ea70e5b626d1ced89b1f9ac045c3395b3e0ee0cb02f8ec5cc4436f8fc8801c9388f3ed7b560af858e875d

Download Submit
C:\Users\Admin\AppData\Roaming\Hyud\omifsu.exe

Filesize
43KB

MD5
a9af4397643b7e1235b3ac8f8ea3c6b2

SHA1
4a7b6a54724fd9968c582841eafe4e80f5ce0c9f

SHA256
00eb70f167a384a90faecdc53857b00a41cea6ca05aa28fda03e48a2010aaf76

SHA512
13fb649cdbbb303209feccda0db6757da404efddc21aca191b791763719dbc5d717c0afb46738617bd07bbc1b906cfc90caaac94771cc4597d26802be6bd53d1

Download Submit
C:\Users\Admin\AppData\Roaming\Hyud\omifsu.exe

Filesize
17KB

MD5
34d61e66b4e25dda40f76967867b9f9c

SHA1
8d1e9b019b7ad12c094db6917a98f091ef438773

SHA256
0ea0fdb395bd2b54c9f5456c6e2fdc97a658ab7474286a13f268993f8ae385b0

SHA512
4e3efccdd21fedb67c484ac5a6199588804647f5bdbbeb59257d7cc8f95980f7fac1b214f320b8a7eef55840286ae43875dc79c7300e1ff22b0ebd70c9625094

Download Submit
\Users\Admin\AppData\Roaming\Hyud\omifsu.exe

Filesize
28KB

MD5
f4d3851018c3da858a98536d830d233b

SHA1
641f37687206408b19262355e081b8454bd2d441

SHA256
688d9a87077cf77916ee54cf5d20abc5bb5c0ce1d5b25c81cc0c7e0e75e03435

SHA512
60daa10695bd495a60e83c4c8091bdfe4ce8dcb397e191b97bc95e0635d221e85d08fc1e5755ae9dd8366a4ea1de36c2c5d1470090b9d0868d794f30993d92cc

Download Submit
\Users\Admin\AppData\Roaming\Hyud\omifsu.exe

Filesize
16KB

MD5
b3a3349998de14a73a6bbdce8a8ca4f1

SHA1
abd510d0b5983dd3e888f9fed03a5ed583ba8995

SHA256
9a34d1a9aecd2f6307ed198a95acfa3f1f16ac3839da8f15e2b7624fef817bd2

SHA512
e1bea3263236f04b0987e52cbd415c3599b92d76f72d8e7cf76a5f4007bb908eaf43ed4c0341842dcc7598e5f51c020cbbd9d9de1449badff7c86b35996b18eb

Download Submit
memory/1228-66-0x0000000000330000-0x0000000000372000-memory.dmp

Filesize
264KB

Download
memory/1228-67-0x0000000000330000-0x0000000000372000-memory.dmp

Filesize
264KB

Download
memory/1228-68-0x0000000000330000-0x0000000000372000-memory.dmp

Filesize
264KB

Download
memory/1228-63-0x0000000000330000-0x0000000000372000-memory.dmp

Filesize
264KB

Download
memory/1228-65-0x0000000000330000-0x0000000000372000-memory.dmp

Filesize
264KB

Download
memory/1368-74-0x00000000001A0000-0x00000000001E2000-memory.dmp

Filesize
264KB

Download
memory/1368-73-0x00000000001A0000-0x00000000001E2000-memory.dmp

Filesize
264KB

Download
memory/1368-72-0x00000000001A0000-0x00000000001E2000-memory.dmp

Filesize
264KB

Download
memory/1368-71-0x00000000001A0000-0x00000000001E2000-memory.dmp

Filesize
264KB

Download
memory/1416-80-0x00000000021E0000-0x0000000002222000-memory.dmp

Filesize
264KB

Download
memory/1416-79-0x00000000021E0000-0x0000000002222000-memory.dmp

Filesize
264KB

Download
memory/1416-78-0x00000000021E0000-0x0000000002222000-memory.dmp

Filesize
264KB

Download
memory/1416-77-0x00000000021E0000-0x0000000002222000-memory.dmp

Filesize
264KB

Download
memory/1628-84-0x00000000004A0000-0x00000000004E2000-memory.dmp

Filesize
264KB

Download
memory/1628-89-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1628-85-0x00000000004A0000-0x00000000004E2000-memory.dmp

Filesize
264KB

Download
memory/1628-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1628-93-0x00000000004A0000-0x0000000000501000-memory.dmp

Filesize
388KB

Download
memory/1628-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1628-83-0x00000000004A0000-0x00000000004E2000-memory.dmp

Filesize
264KB

Download
memory/1628-87-0x0000000000270000-0x00000000002B2000-memory.dmp

Filesize
264KB

Download
memory/1628-88-0x00000000002C0000-0x0000000000321000-memory.dmp

Filesize
388KB

Download
memory/1628-103-0x00000000004A0000-0x00000000004E2000-memory.dmp

Filesize
264KB

Download
memory/1628-102-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1628-86-0x00000000004A0000-0x00000000004E2000-memory.dmp

Filesize
264KB

Download
memory/1628-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1760-98-0x0000000000050000-0x0000000000092000-memory.dmp

Filesize
264KB

Download
memory/1760-106-0x0000000000050000-0x0000000000092000-memory.dmp

Filesize
264KB

Download
memory/1760-99-0x0000000000050000-0x0000000000092000-memory.dmp

Filesize
264KB

Download
memory/1760-100-0x0000000000050000-0x0000000000092000-memory.dmp

Filesize
264KB

Download
memory/1760-96-0x0000000000050000-0x0000000000092000-memory.dmp

Filesize
264KB

Download
memory/1920-91-0x0000000000360000-0x00000000003C1000-memory.dmp

Filesize
388KB

Download
memory/1920-90-0x0000000000270000-0x00000000002B2000-memory.dmp

Filesize
264KB

Download
memory/1920-92-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing