bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb

General

Target

bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe
Size

746KB
MD5

4a61b2c60c2a5b28b67e2f29d684555e
SHA1

9a04cf187fb119b6c2bec5d3f9bd8d4ef1be1195
SHA256

bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb
SHA512

836090d31115098a3a3b1013f767e7100f654fbb791716d58b65328ca56c581d2f239064e5f6e595f8403f85640957ddf79b397c9ba3f069a8828bdb8d9aefa7
SSDEEP

6144:Q6viUNIPcmmmRm4EG76adSNc/B9XgGJ2Fc+y6xL:QtEmREGO8oc/B9Q1xL

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Loads dropped DLL 4 IoCs

pid	Process
1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1784	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1784	1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe	28
PID 1808 wrote to memory of 1784	1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe	28
PID 1808 wrote to memory of 1784	1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe	28
PID 1808 wrote to memory of 1784	1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe	28
PID 1808 wrote to memory of 1784	1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe	28
PID 1808 wrote to memory of 1784	1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe	28
PID 1808 wrote to memory of 1784	1808	bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe	28

C:\Users\Admin\AppData\Local\Temp\bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe
"C:\Users\Admin\AppData\Local\Temp\bd42baf2369981d318d4284a0f178667c5c9eee1b51169d965f273e1704ef9eb.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
  "C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
memory/1784-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1784-67-0x0000000003120000-0x0000000003324000-memory.dmp

Filesize
2.0MB

Download
memory/1808-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1808-54-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1808-65-0x0000000000230000-0x0000000000289000-memory.dmp

Filesize
356KB

Download
memory/1808-66-0x0000000000230000-0x0000000000289000-memory.dmp

Filesize
356KB

Download
memory/1808-68-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1808-69-0x0000000000230000-0x0000000000289000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing