Overview

overview

8

Static

static

1

MEmu-setup...dk.exe

windows7-x64

8

MEmu-setup...dk.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    29s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2023, 08:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    MEmu-setup-abroad-sdk.exe

  • Size

    20.0MB

  • MD5

    581da0f19ef8388a0ba331ce0a617aaf

  • SHA1

    e050d686c3c5972aaf1a4fdec299e764ef9873eb

  • SHA256

    8fb453bf498acb05af9e0a442f26029cd6c5a3d68431fdff7fc385faf1541b96

  • SHA512

    091a019846f2bf431ba7231ebe711d856f0839527c5dd68d59fa91cf22ddfffc7e3ad395ab4bd8b0f9fb90721872c9e2cc4428cb5dc8dd7fd137ff8dc2bb0943

  • SSDEEP

    393216:qpsmQyK0QtLJsv6tWKFdu9CnvUiOnKv647n+YlmYsp:qslbbDfvegmt

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 3 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk.exe
    "C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2040

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          62KB

          MD5

          3ac860860707baaf32469fa7cc7c0192

          SHA1

          c33c2acdaba0e6fa41fd2f00f186804722477639

          SHA256

          d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

          SHA512

          d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          9faf5011481915b61192b0f7fe2023a6

          SHA1

          81f571a33c74086ccce9dd2d3117d920f41d7c02

          SHA256

          bbde99a440e508621d95bdf76b6e74c4ce023d77a1c634135e88bcae9bd32884

          SHA512

          e9bbd4ddb299a08194a353cb076c293130d47db72738f7d8722b236698c7477671984916fbaa212e1ca195bf8698551c42f93d8b9234fdc799d1056cbda89889

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\DotSetupSDK\DotSetupSDK.dll
          Filesize

          29KB

          MD5

          46dc4d4a248045e9ae57fcb0dd9d16fd

          SHA1

          bb3cc7c5b7f243c5fa723d95212e27b5d4b6c328

          SHA256

          1f0856c913ff112625569d293c2acf894dece2ccc8e2c1f3e49b83bf2bfb288c

          SHA512

          bfa716bbea4eded6d992ed356720fcaf24cc0821e81e296967fae0bddb73649182884921079eb22d01a587927334cbdf03f3535418ed1c44e1969ba17542b0fc

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Tar577B.tmp
          Filesize

          164KB

          MD5

          4ff65ad929cd9a367680e0e5b1c08166

          SHA1

          c0af0d4396bd1f15c45f39d3b849ba444233b3a2

          SHA256

          c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

          SHA512

          f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

          Download Submit

        • \Users\Admin\AppData\Local\Temp\DotSetupSDK\DotSetupSDK.dll
          Filesize

          29KB

          MD5

          46dc4d4a248045e9ae57fcb0dd9d16fd

          SHA1

          bb3cc7c5b7f243c5fa723d95212e27b5d4b6c328

          SHA256

          1f0856c913ff112625569d293c2acf894dece2ccc8e2c1f3e49b83bf2bfb288c

          SHA512

          bfa716bbea4eded6d992ed356720fcaf24cc0821e81e296967fae0bddb73649182884921079eb22d01a587927334cbdf03f3535418ed1c44e1969ba17542b0fc

          Download Submit

        • \Users\Admin\AppData\Local\Temp\DotSetupSDK\DotSetupSDK.dll
          Filesize

          29KB

          MD5

          46dc4d4a248045e9ae57fcb0dd9d16fd

          SHA1

          bb3cc7c5b7f243c5fa723d95212e27b5d4b6c328

          SHA256

          1f0856c913ff112625569d293c2acf894dece2ccc8e2c1f3e49b83bf2bfb288c

          SHA512

          bfa716bbea4eded6d992ed356720fcaf24cc0821e81e296967fae0bddb73649182884921079eb22d01a587927334cbdf03f3535418ed1c44e1969ba17542b0fc

          Download Submit

        • \Users\Admin\AppData\Local\Temp\DotSetupSDK\DotSetupSDK.dll
          Filesize

          29KB

          MD5

          46dc4d4a248045e9ae57fcb0dd9d16fd

          SHA1

          bb3cc7c5b7f243c5fa723d95212e27b5d4b6c328

          SHA256

          1f0856c913ff112625569d293c2acf894dece2ccc8e2c1f3e49b83bf2bfb288c

          SHA512

          bfa716bbea4eded6d992ed356720fcaf24cc0821e81e296967fae0bddb73649182884921079eb22d01a587927334cbdf03f3535418ed1c44e1969ba17542b0fc

          Download Submit

        • memory/2040-73-0x0000000003900000-0x0000000003910000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2040-74-0x0000000003AE0000-0x0000000003B20000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2040-196-0x0000000003B20000-0x0000000003B64000-memory.dmp

          Filesize

          272KB

          Download

        • memory/2040-197-0x0000000003AE0000-0x0000000003B20000-memory.dmp

          Filesize

          256KB

          Download