39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f

General

Target

39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
Size

2.4MB
MD5

b463fb72a974f4580d29e19fb2494db8
SHA1

415fcb042059de9ed2e823950876c2847102162c
SHA256

39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f
SHA512

1ac70466958556fc5a263bf37189c69a5f43f17e574f383b4eba5ddbc8475118458a5d62eda8f0b716699f61ea25af00a59fdaa461de3a13632d32337df5602b
SSDEEP

24576:mWO3NfIJv/lOt97/S0yCLRCzfPXCsRaYAM/lfkykiMh9M0Wj2XugCAYph/pprwtn:mbfIDOtJSICusRDAMNMh9M0u2utxWF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Loads dropped DLL 3 IoCs

pid	Process
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2692	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\rumkcl.dll	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
File created	C:\Windows\Fonts\ggsygu.dll	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2692	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2692	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
2692	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2692	2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe	28
PID 2132 wrote to memory of 2692	2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe	28
PID 2132 wrote to memory of 2692	2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe	28
PID 2132 wrote to memory of 2692	2132	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe	28

C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
"C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
  C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe --
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Filesize
2.4MB

MD5
2c7df4d8ba2ef94a03010c3a73adc679

SHA1
58b04d07a91131c61c6282f03353543485df7e26

SHA256
98375e070171d737bea6131dd819d094ea011a22221b0ab560c783d3654d353b

SHA512
1f04f3bc230b8d990b701390f926821494b812923e0c4240b34e4700aa21411ec6ba1e2cd13f8283a37df81cadc7f2fe40767629190ac6318ef0824a7862c85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
2.4MB

MD5
2c7df4d8ba2ef94a03010c3a73adc679

SHA1
58b04d07a91131c61c6282f03353543485df7e26

SHA256
98375e070171d737bea6131dd819d094ea011a22221b0ab560c783d3654d353b

SHA512
1f04f3bc230b8d990b701390f926821494b812923e0c4240b34e4700aa21411ec6ba1e2cd13f8283a37df81cadc7f2fe40767629190ac6318ef0824a7862c85a

Download Submit
C:\Windows\Fonts\ggsygu.dll

Filesize
1.4MB

MD5
736228b33e34445eaf8c16b864294c27

SHA1
6c77cb3c3f6ed94fc61d03383fa19f09a56b3c77

SHA256
c8015c473252a432d131bf2dd53a1172acdc05870de399f4456dce3edbc847cc

SHA512
7849dcccc0f59e89930b57b921ad3733816b6f857c2ae0905f6e1e3221603aba9fd382a3f255e76fb06128376f8f9eb79a0a30d4ea8b476d86a0163535644cec

Download Submit
\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Filesize
2.4MB

MD5
2c7df4d8ba2ef94a03010c3a73adc679

SHA1
58b04d07a91131c61c6282f03353543485df7e26

SHA256
98375e070171d737bea6131dd819d094ea011a22221b0ab560c783d3654d353b

SHA512
1f04f3bc230b8d990b701390f926821494b812923e0c4240b34e4700aa21411ec6ba1e2cd13f8283a37df81cadc7f2fe40767629190ac6318ef0824a7862c85a

Download Submit
\Windows\Fonts\ggsygu.dll

Filesize
1.4MB

MD5
736228b33e34445eaf8c16b864294c27

SHA1
6c77cb3c3f6ed94fc61d03383fa19f09a56b3c77

SHA256
c8015c473252a432d131bf2dd53a1172acdc05870de399f4456dce3edbc847cc

SHA512
7849dcccc0f59e89930b57b921ad3733816b6f857c2ae0905f6e1e3221603aba9fd382a3f255e76fb06128376f8f9eb79a0a30d4ea8b476d86a0163535644cec

Download Submit
\Windows\Fonts\rumkcl.dll

Filesize
1.4MB

MD5
736228b33e34445eaf8c16b864294c27

SHA1
6c77cb3c3f6ed94fc61d03383fa19f09a56b3c77

SHA256
c8015c473252a432d131bf2dd53a1172acdc05870de399f4456dce3edbc847cc

SHA512
7849dcccc0f59e89930b57b921ad3733816b6f857c2ae0905f6e1e3221603aba9fd382a3f255e76fb06128376f8f9eb79a0a30d4ea8b476d86a0163535644cec

Download Submit

Analysis

Sharing