5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc

General

Target

5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe
Size

746KB
MD5

07d3835f17f8570efe10cbd9486223a1
SHA1

494a738cda9c5f82c1994fe005d9f7f22f2f3633
SHA256

5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc
SHA512

0a9b637e6eefe1a37dffba8b4f7f4e19d51e64fea89c270776159a1c4de0d3cf0b0d20b5faad5f6e5f5ec388e8bbc91dbb0b0dbabda88b116f8f4e47c98b5d44
SSDEEP

6144:Q6viUNIPcmmmRm4EG76adSNc/B9XgGJ2Fc+y6xT:QtEmREGO8oc/B9Q1xT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Loads dropped DLL 4 IoCs

pid	Process
1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
1676	Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1676	1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe	28
PID 1788 wrote to memory of 1676	1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe	28
PID 1788 wrote to memory of 1676	1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe	28
PID 1788 wrote to memory of 1676	1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe	28
PID 1788 wrote to memory of 1676	1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe	28
PID 1788 wrote to memory of 1676	1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe	28
PID 1788 wrote to memory of 1676	1788	5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe	28

C:\Users\Admin\AppData\Local\Temp\5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe
"C:\Users\Admin\AppData\Local\Temp\5e41943de9c4c5208fe24025fa35a301f70f75c17c1338db1feac724ca2e72dc.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe
  "C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
C:\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
\Program Files\qimi\Au_7Me.exe_DFA9983F57AF475C964D400A29E73BA4E1738ED2.exe

Filesize
288KB

MD5
d7a053ed5d3cf670ea9c2dab302f0fb9

SHA1
46b1d6a73aaa9e276376546a03855b28b54ec6f4

SHA256
922af7b37aed2a8d1c6fdea17135e8ac4992a30105c49405b9d62e9f6ebaf7b7

SHA512
9f634981bf3b3e34d0e93a2f5b687946b620263c52d25ea66f6769050bc62f811ce44370922c8cbbcf4b3181b21f20ee02454e711853c0bd9622f440e27a98ef

Download Submit
memory/1676-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1676-66-0x0000000002DC0000-0x0000000002FC4000-memory.dmp

Filesize
2.0MB

Download
memory/1676-67-0x0000000002DC0000-0x0000000002FC4000-memory.dmp

Filesize
2.0MB

Download
memory/1788-55-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1788-56-0x0000000000230000-0x0000000000289000-memory.dmp

Filesize
356KB

Download
memory/1788-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing