e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e

General

Target

e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe
Size

133KB
MD5

aafef404650287c7c279ff33826186ee
SHA1

925994f9355d7ace89e3482816aade99525b51f3
SHA256

e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e
SHA512

c2466ec91bab2cf714d006d9235c5351ac581b612e114012656ceff198bde6d0a7719e5e9a54a204f1ddaedf311db3608d799ef53bef630bc8b869a4320b1416
SSDEEP

768:X+RFmnbfWDut1vC+bHyBtMLNe28DUMaV9NvSEqf/Z+:ORFyWuq+bHyBtMLX8DUjVzFqM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	ntldr.exe

Loads dropped DLL 6 IoCs

pid	Process
1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe
1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe
1244	WerFault.exe
1244	WerFault.exe
1244	WerFault.exe
1244	WerFault.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ntldr.exe	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe
File created	C:\Windows\SysWOW64\ntldr.exe	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe
File opened for modification	C:\Windows\SysWOW64\RCXEA21.tmp	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe
File opened for modification	C:\Windows\SysWOW64\ntldr.exe	ntldr.exe
File created	C:\Windows\SysWOW64\ntldr.exe	ntldr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1784	1788	WerFault.exe	27
1244	1976	WerFault.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1976	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	28
PID 1788 wrote to memory of 1976	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	28
PID 1788 wrote to memory of 1976	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	28
PID 1788 wrote to memory of 1976	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	28
PID 1788 wrote to memory of 1784	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	29
PID 1788 wrote to memory of 1784	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	29
PID 1788 wrote to memory of 1784	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	29
PID 1788 wrote to memory of 1784	1788	e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe	29
PID 1976 wrote to memory of 1244	1976	ntldr.exe	30
PID 1976 wrote to memory of 1244	1976	ntldr.exe	30
PID 1976 wrote to memory of 1244	1976	ntldr.exe	30
PID 1976 wrote to memory of 1244	1976	ntldr.exe	30

C:\Users\Admin\AppData\Local\Temp\e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe
"C:\Users\Admin\AppData\Local\Temp\e435664f2cefca1153f662887fcb6656772f1f7f56bfb40680686dbf5a6c0d3e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\ntldr.exe
  "C:\Windows\system32\ntldr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 124
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 124
  2⤵
  - Program crash
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
C:\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
\Windows\SysWOW64\ntldr.exe

Filesize
28KB

MD5
80f9290f521afce325d362ee877acf62

SHA1
04b7ba722b02dbd7d0df092cdfca61474537af2f

SHA256
8d2a997f844c4ced9fe35154ea7467e8183f3d2aba6e1532bb60b87820cbedf4

SHA512
27c53cd7b961c836e5d71041803a103fb371e4e26b7ac62d97ecbb0b5a702a689c9159bcf7a050d0256354b582b9a8c4c1aaebc58906e2bcd7e95065aef484be

Download Submit
memory/1788-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads