16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f

General

Target

16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe
Size

606KB
MD5

08554316315d5f656d0269ecef891920
SHA1

d0ef0cbda62198c9879076948c63ded6e6a700eb
SHA256

16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f
SHA512

b2fc5b064ff7f6282c13025087e324f48b33ef3f594098ac8366757260b89c33eb2ced73285e5c85846af5892e05353c5787b27603622195a8edd64d220c67d4
SSDEEP

3072:QYGbeS0h4u57lQbrnezHqRCHMseH6oVjTAkKoA/pyaupupupupuj:QYGblOxmrnimCHMPHlRKoA/0fooooj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Loads dropped DLL 5 IoCs

pid	Process
1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe
1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe
1488	new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1488	1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe	27
PID 1108 wrote to memory of 1488	1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe	27
PID 1108 wrote to memory of 1488	1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe	27
PID 1108 wrote to memory of 1488	1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe	27
PID 1108 wrote to memory of 1488	1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe	27
PID 1108 wrote to memory of 1488	1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe	27
PID 1108 wrote to memory of 1488	1108	16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe	27

C:\Users\Admin\AppData\Local\Temp\16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe
"C:\Users\Admin\AppData\Local\Temp\16e08dfa68ccbb3fb85c873e32c2ab18b62bd7125d6f5e3ef7df070ef4c5301f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe
  "C:\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Filesize
252KB

MD5
251ab27eb6eaa523df20f68b2c2c2628

SHA1
b319d0984b27a9fef399111ee79ed9cbf10f6cae

SHA256
99937cd0c019d1935340463fecc5ee45ac083faf61661267a9c516c4edb1f6ca

SHA512
582f92245306e2d89638b4491e62b78bc938300f6aef8f2b9740515eaf499fefc549d49449e9ffc4cbb0128735bec193bdc45c0b3c7cdbff1fa4326a1e8663d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Filesize
252KB

MD5
251ab27eb6eaa523df20f68b2c2c2628

SHA1
b319d0984b27a9fef399111ee79ed9cbf10f6cae

SHA256
99937cd0c019d1935340463fecc5ee45ac083faf61661267a9c516c4edb1f6ca

SHA512
582f92245306e2d89638b4491e62b78bc938300f6aef8f2b9740515eaf499fefc549d49449e9ffc4cbb0128735bec193bdc45c0b3c7cdbff1fa4326a1e8663d2

Download Submit
\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Filesize
252KB

MD5
251ab27eb6eaa523df20f68b2c2c2628

SHA1
b319d0984b27a9fef399111ee79ed9cbf10f6cae

SHA256
99937cd0c019d1935340463fecc5ee45ac083faf61661267a9c516c4edb1f6ca

SHA512
582f92245306e2d89638b4491e62b78bc938300f6aef8f2b9740515eaf499fefc549d49449e9ffc4cbb0128735bec193bdc45c0b3c7cdbff1fa4326a1e8663d2

Download Submit
\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Filesize
252KB

MD5
251ab27eb6eaa523df20f68b2c2c2628

SHA1
b319d0984b27a9fef399111ee79ed9cbf10f6cae

SHA256
99937cd0c019d1935340463fecc5ee45ac083faf61661267a9c516c4edb1f6ca

SHA512
582f92245306e2d89638b4491e62b78bc938300f6aef8f2b9740515eaf499fefc549d49449e9ffc4cbb0128735bec193bdc45c0b3c7cdbff1fa4326a1e8663d2

Download Submit
\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Filesize
252KB

MD5
251ab27eb6eaa523df20f68b2c2c2628

SHA1
b319d0984b27a9fef399111ee79ed9cbf10f6cae

SHA256
99937cd0c019d1935340463fecc5ee45ac083faf61661267a9c516c4edb1f6ca

SHA512
582f92245306e2d89638b4491e62b78bc938300f6aef8f2b9740515eaf499fefc549d49449e9ffc4cbb0128735bec193bdc45c0b3c7cdbff1fa4326a1e8663d2

Download Submit
\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Filesize
252KB

MD5
251ab27eb6eaa523df20f68b2c2c2628

SHA1
b319d0984b27a9fef399111ee79ed9cbf10f6cae

SHA256
99937cd0c019d1935340463fecc5ee45ac083faf61661267a9c516c4edb1f6ca

SHA512
582f92245306e2d89638b4491e62b78bc938300f6aef8f2b9740515eaf499fefc549d49449e9ffc4cbb0128735bec193bdc45c0b3c7cdbff1fa4326a1e8663d2

Download Submit
\Users\Admin\AppData\Local\Temp\new_hhh258.exe_E0CE4CB668B26FCF6526740CF49A3AF5B9E9FEB4.exe

Filesize
252KB

MD5
251ab27eb6eaa523df20f68b2c2c2628

SHA1
b319d0984b27a9fef399111ee79ed9cbf10f6cae

SHA256
99937cd0c019d1935340463fecc5ee45ac083faf61661267a9c516c4edb1f6ca

SHA512
582f92245306e2d89638b4491e62b78bc938300f6aef8f2b9740515eaf499fefc549d49449e9ffc4cbb0128735bec193bdc45c0b3c7cdbff1fa4326a1e8663d2

Download Submit
memory/1108-67-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1108-55-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1108-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1108-68-0x0000000000230000-0x000000000027E000-memory.dmp

Filesize
312KB

Download
memory/1488-62-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-69-0x0000000002F30000-0x0000000003134000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing