61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04

General

Target

61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe
Size

606KB
MD5

60077816cf9bb0fca169a99ccd5f3827
SHA1

2ab7e0bdeebb0ccf800f655974e5c00f989fd8a3
SHA256

61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04
SHA512

e168987c67bd3d17848f696e8ba948918d576b4872cc22bf82610528a60d2b1ff7d1c3f15e205981aa73ee4c9ae7d5ed33dafaea48aaf53b4b5f5e6f57f37951
SSDEEP

3072:QdGbeS0hEzGxWT17ti/1j0qsOJRJPOmE8jjYk8ObH86hFgVxEeWWWWH:QdGbVKxWTvHqsG7Pm8jszQoVj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Loads dropped DLL 5 IoCs

pid	Process
1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe
1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe
1104	new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1104	1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe	27
PID 1620 wrote to memory of 1104	1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe	27
PID 1620 wrote to memory of 1104	1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe	27
PID 1620 wrote to memory of 1104	1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe	27
PID 1620 wrote to memory of 1104	1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe	27
PID 1620 wrote to memory of 1104	1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe	27
PID 1620 wrote to memory of 1104	1620	61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe	27

C:\Users\Admin\AppData\Local\Temp\61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe
"C:\Users\Admin\AppData\Local\Temp\61e01bf87507376bd1292d99e097e9fdabed698d3f67ec2602495262ea460c04.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe
  "C:\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Filesize
252KB

MD5
3d10636ad0ee38aec221868900151044

SHA1
0de854aaad48c750f9a0a81b30681901d8bd6a3d

SHA256
959fbf958774a7eb5455e56342213f6802d7b6f7abba60deba6705009bc3b966

SHA512
b0740643f8960d95f7fe1267f6a93db3e35a7b442f65e73b65573eae6a52b95c8da28c5c3324278bb70cb96bd75889541e41a983b92c35e335660159d0c2c551

Download Submit
C:\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Filesize
252KB

MD5
3d10636ad0ee38aec221868900151044

SHA1
0de854aaad48c750f9a0a81b30681901d8bd6a3d

SHA256
959fbf958774a7eb5455e56342213f6802d7b6f7abba60deba6705009bc3b966

SHA512
b0740643f8960d95f7fe1267f6a93db3e35a7b442f65e73b65573eae6a52b95c8da28c5c3324278bb70cb96bd75889541e41a983b92c35e335660159d0c2c551

Download Submit
\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Filesize
252KB

MD5
3d10636ad0ee38aec221868900151044

SHA1
0de854aaad48c750f9a0a81b30681901d8bd6a3d

SHA256
959fbf958774a7eb5455e56342213f6802d7b6f7abba60deba6705009bc3b966

SHA512
b0740643f8960d95f7fe1267f6a93db3e35a7b442f65e73b65573eae6a52b95c8da28c5c3324278bb70cb96bd75889541e41a983b92c35e335660159d0c2c551

Download Submit
\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Filesize
252KB

MD5
3d10636ad0ee38aec221868900151044

SHA1
0de854aaad48c750f9a0a81b30681901d8bd6a3d

SHA256
959fbf958774a7eb5455e56342213f6802d7b6f7abba60deba6705009bc3b966

SHA512
b0740643f8960d95f7fe1267f6a93db3e35a7b442f65e73b65573eae6a52b95c8da28c5c3324278bb70cb96bd75889541e41a983b92c35e335660159d0c2c551

Download Submit
\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Filesize
252KB

MD5
3d10636ad0ee38aec221868900151044

SHA1
0de854aaad48c750f9a0a81b30681901d8bd6a3d

SHA256
959fbf958774a7eb5455e56342213f6802d7b6f7abba60deba6705009bc3b966

SHA512
b0740643f8960d95f7fe1267f6a93db3e35a7b442f65e73b65573eae6a52b95c8da28c5c3324278bb70cb96bd75889541e41a983b92c35e335660159d0c2c551

Download Submit
\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Filesize
252KB

MD5
3d10636ad0ee38aec221868900151044

SHA1
0de854aaad48c750f9a0a81b30681901d8bd6a3d

SHA256
959fbf958774a7eb5455e56342213f6802d7b6f7abba60deba6705009bc3b966

SHA512
b0740643f8960d95f7fe1267f6a93db3e35a7b442f65e73b65573eae6a52b95c8da28c5c3324278bb70cb96bd75889541e41a983b92c35e335660159d0c2c551

Download Submit
\Users\Admin\AppData\Local\Temp\new_60sao.exe_E12A56C3EC024F0FEB3D086DB9DA902989B294A2.exe

Filesize
252KB

MD5
3d10636ad0ee38aec221868900151044

SHA1
0de854aaad48c750f9a0a81b30681901d8bd6a3d

SHA256
959fbf958774a7eb5455e56342213f6802d7b6f7abba60deba6705009bc3b966

SHA512
b0740643f8960d95f7fe1267f6a93db3e35a7b442f65e73b65573eae6a52b95c8da28c5c3324278bb70cb96bd75889541e41a983b92c35e335660159d0c2c551

Download Submit
memory/1104-62-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1104-69-0x0000000002E40000-0x0000000003044000-memory.dmp

Filesize
2.0MB

Download
memory/1620-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1620-55-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1620-67-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1620-68-0x00000000002F0000-0x000000000033E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing