Analysis
-
max time kernel
635s -
max time network
669s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 15:00
General
-
Target
MEmu-setup-abroad-sdk.exe
-
Size
20.0MB
-
MD5
581da0f19ef8388a0ba331ce0a617aaf
-
SHA1
e050d686c3c5972aaf1a4fdec299e764ef9873eb
-
SHA256
8fb453bf498acb05af9e0a442f26029cd6c5a3d68431fdff7fc385faf1541b96
-
SHA512
091a019846f2bf431ba7231ebe711d856f0839527c5dd68d59fa91cf22ddfffc7e3ad395ab4bd8b0f9fb90721872c9e2cc4428cb5dc8dd7fd137ff8dc2bb0943
-
SSDEEP
393216:qpsmQyK0QtLJsv6tWKFdu9CnvUiOnKv647n+YlmYsp:qslbbDfvegmt
Malware Config
Signatures
-
Downloads MZ/PE file
-
Loads dropped DLL 3 IoCs
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk.exe"C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk.exe"1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD50d1aad3d9ac30038b9594b0feeec254e
SHA12d5fc5bcfcc6ef131aa56d23bbe9de3db8fd65a2
SHA2565470f9ca8260c30dc82260fb773b2506f986ba1185b038f48a433a6512154811
SHA512111d1e3193fbddbc1d54b7d0d013ca100466c635d1bcdd2d9af6d430a01cfbb3edc8a3848a98ada9e2839349069e06b066663b4144a44af8356a4ecca62ad666
-
Filesize
30KB
MD50d1aad3d9ac30038b9594b0feeec254e
SHA12d5fc5bcfcc6ef131aa56d23bbe9de3db8fd65a2
SHA2565470f9ca8260c30dc82260fb773b2506f986ba1185b038f48a433a6512154811
SHA512111d1e3193fbddbc1d54b7d0d013ca100466c635d1bcdd2d9af6d430a01cfbb3edc8a3848a98ada9e2839349069e06b066663b4144a44af8356a4ecca62ad666
-
Filesize
30KB
MD50d1aad3d9ac30038b9594b0feeec254e
SHA12d5fc5bcfcc6ef131aa56d23bbe9de3db8fd65a2
SHA2565470f9ca8260c30dc82260fb773b2506f986ba1185b038f48a433a6512154811
SHA512111d1e3193fbddbc1d54b7d0d013ca100466c635d1bcdd2d9af6d430a01cfbb3edc8a3848a98ada9e2839349069e06b066663b4144a44af8356a4ecca62ad666
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
272KB