2cdfe2abd98cb1042c905611466553a444a955ba5d3797d11bea7469b3ce334f

General

Target

aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
Size

8.3MB
MD5

71e83ee2d42e1d3a0714c7791675fd83
SHA1

7dccf3322913ee83070bfaa461a05b54486d8d52
SHA256

aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de
SHA512

ecfd5e04c6b930534d1c9736cce9abd487c01a9f6219961bcfe7b9ff360dff89886849b875ae290adbb72d53b604f35564259b911aa1148ecf54289b84813f7d
SSDEEP

196608:jWqVkkK1ilhlXpUZhemwD65z08tBUsVDS3yAeaBX:ZVkd8lXpkl35I8tB9q

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\d3dx11_43.dll	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
File created	C:\Windows\System32\d3dcompiler_43.dll	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
File created	C:\Windows\System32\d3dx9_43.dll	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
580	1356	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 580	1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe	28
PID 1356 wrote to memory of 580	1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe	28
PID 1356 wrote to memory of 580	1356	aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe	28

C:\Users\Admin\AppData\Local\Temp\aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
"C:\Users\Admin\AppData\Local\Temp\aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1356 -s 212
  2⤵
  - Program crash
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\d3dcompiler_43.dll

Filesize
2.4MB

MD5
ada0c39d4eacdc81fd84163a95d62079

SHA1
207321f1b449985b2d06ed50b989fa6259e4eb8e

SHA256
44c3a7e330b54a35a9efa015831392593aa02e7da1460be429d17c3644850e8a

SHA512
1afc63db5d2030b76abc19094fc9fef28cc6250bd265294647e65db81f13749c867722924460f7a6021c739f4057f95501f0322cdec28a2101bf94164557a1a5

Download Submit
\Windows\System32\d3dx11_43.dll

Filesize
270KB

MD5
9d6429f410597750b2dc2579b2347303

SHA1
e35acb15ea52f6cd0587b4ca8da0486b859fd048

SHA256
981e42629df751217406e7150477cddc853b79abd6a8568a1566298ed8f7bd59

SHA512
46cbfb1e22c3f469bdc80515560448f6f83607fd6974bb68b9c7f86ca10c69878f1312b32c81c0f57b931c43bad80bd46bdf26ab4ffb999abb0b73de27ad7c56

Download Submit
memory/1356-54-0x00000000770A0000-0x00000000770A2000-memory.dmp

Filesize
8KB

Download
memory/1356-55-0x00000000770A0000-0x00000000770A2000-memory.dmp

Filesize
8KB

Download
memory/1356-56-0x00000000770A0000-0x00000000770A2000-memory.dmp

Filesize
8KB

Download
memory/1356-57-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/1356-58-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/1356-59-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/1356-60-0x0000000140000000-0x0000000141437000-memory.dmp

Filesize
20.2MB

Download
memory/1356-68-0x0000000180000000-0x000000018014B000-memory.dmp

Filesize
1.3MB

Download
memory/1356-69-0x0000000180000000-0x000000018014B000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing