55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321

General

Target

55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
Size

1.5MB
MD5

f7e76694da9f8d247b6a75f62ab1dc40
SHA1

f0e770517eddb5e730810f5937e6744e87c25a35
SHA256

55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321
SHA512

0b2cc871f5361284697fbe4eefea2378a2ff6815905b486202ffbbd91f3e4e783218aee9a63811c9173f6d099f7576ec9f15072344bb39e291e0af2c51986e0b
SSDEEP

24576:z6Lk1sQfWDZtaXR5x0UHcuUWw0DKEXE+f5npKp8HYMtZkMogTAHl1DZIY50u3phh:GLk1GZcdcuXdFnpKp8HlIMoksLDZLGQp

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1604	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 944 set thread context of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
1876	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 944 wrote to memory of 1876	944	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	27
PID 1876 wrote to memory of 1604	1876	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	30
PID 1876 wrote to memory of 1604	1876	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	30
PID 1876 wrote to memory of 1604	1876	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	30
PID 1876 wrote to memory of 1604	1876	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	30

C:\Users\Admin\AppData\Local\Temp\55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
"C:\Users\Admin\AppData\Local\Temp\55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
  C:\Users\Admin\AppData\Local\Temp\55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\3509NS~1.BAT"
    3⤵
    - Deletes itself
    PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\3509NsCf63HGsyYA73.bat

Filesize
201B

MD5
cab696c134b1730bb07b57e6cc3d3aa6

SHA1
96d8d93878e6a5511326e3479b525f44cb34b4ee

SHA256
f424be20304238861e1300f80b876e68fc1fde2d90e88d1a8a8a1cf87573d4c9

SHA512
313efa073275afbc4cf672e212f39ddcf10df9bbf2d13f0cd615b7700de5050ec80f7e82a3720fb717d1e3b4ce85e9eb4790704154fb05adf80d512fc10f1326

Download Submit
memory/944-62-0x0000000000240000-0x0000000000244000-memory.dmp

Filesize
16KB

Download
memory/944-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1876-67-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1876-60-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1876-63-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1876-65-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1876-58-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1876-71-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1876-72-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1876-73-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1876-57-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1876-75-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1876-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download

Analysis

Sharing