4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379

General

Target

4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
Size

24.4MB
MD5

8c22d2b151a0f61ad4c7d1650f570d78
SHA1

1115fbd271d01dc4a6e70e21e3d187f4a2cb0a53
SHA256

4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379
SHA512

3b9a0d073b76c0bb8a65fe2c1b26dfd576c77b15765f02edd948d22f84b6fdd634608ebf5e2bba3008ec5fcb5894aeb457672607fa11d20c1991b1595eb83f57
SSDEEP

393216:m5ZIx6KEtUVCVs0s8TgLuOCm61UYWWhCf8+QpWUZeKum3mSi44y:JxLEOVCsLLCmmUjW48+MZ3mSiE

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

¹ý¼ì²â²¹¶¡.exeWinHvqf32.exe

pid process

680 ¹ý¼ì²â²¹¶¡.exe
1764 WinHvqf32.exe

pid	process
680	¹ý¼ì²â²¹¶¡.exe
1764	WinHvqf32.exe

Loads dropped DLL 4 IoCs

Processes:

4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe¹ý¼ì²â²¹¶¡.exe

pid	process
1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
680	¹ý¼ì²â²¹¶¡.exe
680	¹ý¼ì²â²¹¶¡.exe

Drops file in System32 directory 3 IoCs

Processes:

4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe¹ý¼ì²â²¹¶¡.exe

description	ioc	process
File created	C:\Windows\SysWOW64\¹ý¼ì²â²¹¶¡.exe	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
File created	C:\Windows\SysWOW64\WinHvqf32.exe	¹ý¼ì²â²¹¶¡.exe
File opened for modification	C:\Windows\SysWOW64\WinHvqf32.exe	¹ý¼ì²â²¹¶¡.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

¹ý¼ì²â²¹¶¡.exe

description pid process

Token: SeIncBasePriorityPrivilege 680 ¹ý¼ì²â²¹¶¡.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	680	¹ý¼ì²â²¹¶¡.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe

pid	process
1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe¹ý¼ì²â²¹¶¡.exe

description	pid	process	target process
PID 1368 wrote to memory of 680	1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe	¹ý¼ì²â²¹¶¡.exe
PID 1368 wrote to memory of 680	1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe	¹ý¼ì²â²¹¶¡.exe
PID 1368 wrote to memory of 680	1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe	¹ý¼ì²â²¹¶¡.exe
PID 1368 wrote to memory of 680	1368	4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe	¹ý¼ì²â²¹¶¡.exe
PID 680 wrote to memory of 1764	680	¹ý¼ì²â²¹¶¡.exe	WinHvqf32.exe
PID 680 wrote to memory of 1764	680	¹ý¼ì²â²¹¶¡.exe	WinHvqf32.exe
PID 680 wrote to memory of 1764	680	¹ý¼ì²â²¹¶¡.exe	WinHvqf32.exe
PID 680 wrote to memory of 1764	680	¹ý¼ì²â²¹¶¡.exe	WinHvqf32.exe
PID 680 wrote to memory of 1828	680	¹ý¼ì²â²¹¶¡.exe	cmd.exe
PID 680 wrote to memory of 1828	680	¹ý¼ì²â²¹¶¡.exe	cmd.exe
PID 680 wrote to memory of 1828	680	¹ý¼ì²â²¹¶¡.exe	cmd.exe
PID 680 wrote to memory of 1828	680	¹ý¼ì²â²¹¶¡.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe
"C:\Users\Admin\AppData\Local\Temp\4aed18bab6ee34c5e7a9f93f3b485065fd1cebfaf1eb99da6ab05ec61c96d379.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\¹ý¼ì²â²¹¶¡.exe
C:\Windows\system32\\¹ý¼ì²â²¹¶¡.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\WinHvqf32.exe
"C:\Windows\system32\WinHvqf32.exe"
3⤵
- Executes dropped EXE
PID:1764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\83A0~1.EXE > nul
3⤵
PID:1828

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\¹ý¼ì²â²¹¶¡.exe
Filesize
17KB

MD5
ea109b0885ee21441931d31e7e222b0b

SHA1
02ea7d1663010ad38e9f67583a41901a484515fe

SHA256
b1ce58eb5174f7af59c422f1d5f6ee0edd39d43bb34cfe1b3f3c69b6dff31c99

SHA512
0deaa656113de3c0fcd0ff4b5102578bf70c51816b94d48312e4ce780d5ea28ce598b035b54ea9c96385a2ddb52f0e9d96ca3d2029124f2159828a219e5ee5d6

Download Submit
C:\Windows\SysWOW64\¹ý¼ì²â²¹¶¡.exe
Filesize
17KB

MD5
ea109b0885ee21441931d31e7e222b0b

SHA1
02ea7d1663010ad38e9f67583a41901a484515fe

SHA256
b1ce58eb5174f7af59c422f1d5f6ee0edd39d43bb34cfe1b3f3c69b6dff31c99

SHA512
0deaa656113de3c0fcd0ff4b5102578bf70c51816b94d48312e4ce780d5ea28ce598b035b54ea9c96385a2ddb52f0e9d96ca3d2029124f2159828a219e5ee5d6

Download Submit
\Windows\SysWOW64\WinHvqf32.exe
Filesize
17KB

MD5
ea109b0885ee21441931d31e7e222b0b

SHA1
02ea7d1663010ad38e9f67583a41901a484515fe

SHA256
b1ce58eb5174f7af59c422f1d5f6ee0edd39d43bb34cfe1b3f3c69b6dff31c99

SHA512
0deaa656113de3c0fcd0ff4b5102578bf70c51816b94d48312e4ce780d5ea28ce598b035b54ea9c96385a2ddb52f0e9d96ca3d2029124f2159828a219e5ee5d6

Download Submit
\Windows\SysWOW64\WinHvqf32.exe
Filesize
17KB

MD5
ea109b0885ee21441931d31e7e222b0b

SHA1
02ea7d1663010ad38e9f67583a41901a484515fe

SHA256
b1ce58eb5174f7af59c422f1d5f6ee0edd39d43bb34cfe1b3f3c69b6dff31c99

SHA512
0deaa656113de3c0fcd0ff4b5102578bf70c51816b94d48312e4ce780d5ea28ce598b035b54ea9c96385a2ddb52f0e9d96ca3d2029124f2159828a219e5ee5d6

Download Submit
\Windows\SysWOW64\¹ý¼ì²â²¹¶¡.exe
Filesize
17KB

MD5
ea109b0885ee21441931d31e7e222b0b

SHA1
02ea7d1663010ad38e9f67583a41901a484515fe

SHA256
b1ce58eb5174f7af59c422f1d5f6ee0edd39d43bb34cfe1b3f3c69b6dff31c99

SHA512
0deaa656113de3c0fcd0ff4b5102578bf70c51816b94d48312e4ce780d5ea28ce598b035b54ea9c96385a2ddb52f0e9d96ca3d2029124f2159828a219e5ee5d6

Download Submit
\Windows\SysWOW64\¹ý¼ì²â²¹¶¡.exe
Filesize
17KB

MD5
ea109b0885ee21441931d31e7e222b0b

SHA1
02ea7d1663010ad38e9f67583a41901a484515fe

SHA256
b1ce58eb5174f7af59c422f1d5f6ee0edd39d43bb34cfe1b3f3c69b6dff31c99

SHA512
0deaa656113de3c0fcd0ff4b5102578bf70c51816b94d48312e4ce780d5ea28ce598b035b54ea9c96385a2ddb52f0e9d96ca3d2029124f2159828a219e5ee5d6

Download Submit
memory/680-57-0x0000000000000000-mapping.dmp

Download
memory/1368-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1764-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads