fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f

General

Target

fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe
Size

489KB
MD5

b37021af41e73af71f6091b289d5297e
SHA1

aaea82ec9b7b2b14685c9a92b0bca7dc9ab323ca
SHA256

fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f
SHA512

d135effc5d111b777f59a83a506ce28a35bf0082a5d8cd3c1798ec4293bd6dab61ad78d4d21ca139fbbfab5d79ab51638ebbc881f0604b0a930e02f00573654a
SSDEEP

12288:CICecBuwQhPYcG4pn18IwvDca4oNtTirdOj:CL7ButYT4fBOTEdOj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
532	guocyok88.exe

Loads dropped DLL 2 IoCs

pid	Process
532	guocyok88.exe
532	guocyok88.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\GUOCYOKl.BAT	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe
File created	C:\Windows\FJOPZK.DAT	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe
File created	C:\Windows\guocyok88.exe	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe
File opened for modification	C:\Windows\guocyok88.exe	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2256	768	WerFault.exe	79
3068	532	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe
Token: SeDebugPrivilege	532	guocyok88.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
532	guocyok88.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
532	guocyok88.exe
532	guocyok88.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 5088	768	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe	87
PID 768 wrote to memory of 5088	768	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe	87
PID 768 wrote to memory of 5088	768	fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe	87
PID 532 wrote to memory of 2192	532	guocyok88.exe	86
PID 532 wrote to memory of 2192	532	guocyok88.exe	86

C:\Users\Admin\AppData\Local\Temp\fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe
"C:\Users\Admin\AppData\Local\Temp\fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 324
  2⤵
  - Program crash
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\GUOCYOKl.BAT
  2⤵
  PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 768 -ip 768
1⤵
PID:444

C:\Windows\guocyok88.exe
C:\Windows\guocyok88.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 320
  2⤵
  - Program crash
  PID:3068
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 532 -ip 532
1⤵
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\FJOPZK.DAT

Filesize
34KB

MD5
97551a319b2daad0f89319d8c9df445e

SHA1
a655b62f571d1b2b98f9b47ca93f7be61b4e0e2f

SHA256
64bfbbb37e5441c79ce810c4aa78a498728af81f53565a2affabddd5c6f61a7d

SHA512
20c52e94ed5ac353a0158e2d7c07459e8e2a5e2307f79462204225b45f8642f5c6863f16754920d25c208965f3d4124d79509e6f5fc24b259f31b454895ba5f8

Download Submit
C:\Windows\FJOPZK.DAT

Filesize
34KB

MD5
97551a319b2daad0f89319d8c9df445e

SHA1
a655b62f571d1b2b98f9b47ca93f7be61b4e0e2f

SHA256
64bfbbb37e5441c79ce810c4aa78a498728af81f53565a2affabddd5c6f61a7d

SHA512
20c52e94ed5ac353a0158e2d7c07459e8e2a5e2307f79462204225b45f8642f5c6863f16754920d25c208965f3d4124d79509e6f5fc24b259f31b454895ba5f8

Download Submit
C:\Windows\FJOPZK.DAT

Filesize
34KB

MD5
97551a319b2daad0f89319d8c9df445e

SHA1
a655b62f571d1b2b98f9b47ca93f7be61b4e0e2f

SHA256
64bfbbb37e5441c79ce810c4aa78a498728af81f53565a2affabddd5c6f61a7d

SHA512
20c52e94ed5ac353a0158e2d7c07459e8e2a5e2307f79462204225b45f8642f5c6863f16754920d25c208965f3d4124d79509e6f5fc24b259f31b454895ba5f8

Download Submit
C:\Windows\GUOCYOKl.BAT

Filesize
254B

MD5
ee56b557b93f7a04dc61a7b113ca8e4f

SHA1
375f6f2d4dc84fadea5a81521b2cdd7f65a257db

SHA256
49edca85641c490c307927aa453f848943a1eef4368438b2143c181f6e391da2

SHA512
78e73b53f65d3d7916394673f0719f537a098fe756378cc04402299a2182c430dd6c485fa7bbb3e00313ebca14c2f4e5fcc9cef9eb6961709468d455de2b33ec

Download Submit
C:\Windows\guocyok88.exe

Filesize
489KB

MD5
b37021af41e73af71f6091b289d5297e

SHA1
aaea82ec9b7b2b14685c9a92b0bca7dc9ab323ca

SHA256
fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f

SHA512
d135effc5d111b777f59a83a506ce28a35bf0082a5d8cd3c1798ec4293bd6dab61ad78d4d21ca139fbbfab5d79ab51638ebbc881f0604b0a930e02f00573654a

Download Submit
C:\Windows\guocyok88.exe

Filesize
489KB

MD5
b37021af41e73af71f6091b289d5297e

SHA1
aaea82ec9b7b2b14685c9a92b0bca7dc9ab323ca

SHA256
fe2361e4065127f42174ddcf7ba0260e6257973db4f890826b34f61746a62f2f

SHA512
d135effc5d111b777f59a83a506ce28a35bf0082a5d8cd3c1798ec4293bd6dab61ad78d4d21ca139fbbfab5d79ab51638ebbc881f0604b0a930e02f00573654a

Download Submit
memory/532-136-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/532-139-0x00000000006A0000-0x00000000006E3000-memory.dmp

Filesize
268KB

Download
memory/532-143-0x00000000018F0000-0x0000000001903000-memory.dmp

Filesize
76KB

Download
memory/768-137-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/768-132-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/768-133-0x00000000009A0000-0x00000000009E3000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing