Analysis
-
max time kernel
1566s -
max time network
1570s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
02-12-2023 13:53
Behavioral task
behavioral1
Sample
uex/setup.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
uex/setup.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
uex/uex.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
uex/uex.exe
Resource
win10v2004-20231130-en
General
-
Target
uex/uex.exe
-
Size
12.0MB
-
MD5
e9f66568451a14003ec21c22d9cfce35
-
SHA1
b5c8156a89b54a146d645e917e93017078e993d4
-
SHA256
fac4a406209de8275865722de6805574e8be3e35e3ffa7d1c00e61fd62b413cd
-
SHA512
e7884875f9e86fbb3b1c5481fa1d3fbdf2ced0adbb30b541de9a44eedf6a27745c50209ef8999700539fc136d0f071046a693745c9d79dbbc65a0abf810df6a2
-
SSDEEP
196608:gJ3FBfF3hPXieIVTB9onJ5hrZERlyiU8AdZYJERS48RmU/ITvN8wZlsPvZBdcMch:OPfF3dgH9c5hlERJAdZYygtNITfZWG80
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2344 uex.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 536 wrote to memory of 2344 536 uex.exe 29 PID 536 wrote to memory of 2344 536 uex.exe 29 PID 536 wrote to memory of 2344 536 uex.exe 29
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD511c051f93c922d6b6b4829772f27a5be
SHA142fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA2560eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
SHA5121cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6
-
Filesize
80B
MD5550bbf2c4a6139df5c6c8c378b744b36
SHA1a77ec3099bd811427b8a4994b232f22ef8109d17
SHA25665b387fa85b9cb128b7ebdd570441cc5581e07b2a1d50ce4d67aa4c55cb48eef
SHA5125bd09a8b4360a2a229b88a8ecb846c26bfd34ef796888988bdd43386b646a5e5e065c55141868aaca46ff4edc1b9c061d2d39bfcb4432d43ce59235a4d659c99
-
C:\Users\Admin\AppData\Local\Temp\_MEI5362\ttkthemes\gif\equilux\equilux\checkbox-unchecked-insensitive.gif
Filesize63B
MD531e364b43cbf9100c40f36f7d8323047
SHA138f545eb60bfa418b1f3e385cb4b7823f1d3e4a2
SHA256196ee8dfdeb3c1d86da8c37d8890d74918967fe2c5fa9f3932ba6f01410ce5d6
SHA5129718538fb925a6763f0039ed7b9199801391214622f43f1fb12b9e6069eff8ad1b2b0f91e6ecd042766955383d4e34ea4288c46d68045ed2ab8737c08425d907
-
Filesize
559B
MD56910ffa258d2c329f87c9af02f167967
SHA1c99761e996f1e3486efd234c96808dea6a713db5
SHA256af4fe13771079c7ad6aab7bea8f5915dd88194429a9100950aadc227e79d062e
SHA5123f6e7f955589dcc383af9d8af1e9a5fd72fffb440a4d4f086881e3ea5d089faf768c7e4cbb3424fbb63345e4f7a0e29c485206b6ac430657e828f592ec1d38de
-
Filesize
550B
MD5833c0259908d1f1af01a5c0627b0f2eb
SHA18a6747689d5eb0b4f0e99b01640ca017220ee48f
SHA2566d8e082b7c935f61150335a0cf01f606126e8cd08a118948c3a0c507ad8f08ee
SHA51220e6588e93f061be45486a436b019ee435cd781dbf519a68d6085fbb46743e87f4fc617537bdc9944788c34531a7bd3beca9c20e5771c3eca496691117b1bc82
-
Filesize
353B
MD5d9b45a320c4103307809fa781097c261
SHA19c8a170c24e940573876156853da231083ad0561
SHA256319fd174f91649aa56b3340b97aae7467acb301d532a56fcea2e5d57834a9c2f
SHA512130fa968aa5d7ed3557ae5695610bff2076d619c2f585212744148eadb9921f637c16e345a6762d8df65e221908aafd1e70a52ce176ccdc7bafd07b5620a81fe
-
Filesize
251B
MD5d492994180730fa86597f976cfbb7a01
SHA12100d1e621691cf4a640704ac09898b6b891d845
SHA25686332694130c170c65c5b890fdb999054fa970124b355adca6242708273a0adc
SHA512303419418e69936b1460513c968fbef69f2f9f57fbe1331a6285987cb8fb2fbb5e2b18b3292a4f55da05b25f4aaf284ef52f1b15b77a06b348989b73b687d835
-
Filesize
92B
MD59f3940648ec830e5180e79b1d799a347
SHA1eab0529f7fc30d50da53b042af0bdda127fca573
SHA256e6b5b7a553293b377ad7368426b90edac14bda4d7b3f3ff09f5d935d56e79dfb
SHA5122764dff79dc098ec8f8c09d5e6dfc370785258188dd8877f19416e0c32584ddf3113adf2bc1c87cb2aa9e2e9fef526c76e37b1f899228885471a209ec8a2420f
-
Filesize
548B
MD5e7dd8e7e8e8e2c91f1c54bb55d524015
SHA18994c05004ebcccef17787ddfd050e4143137b0e
SHA256bd47ec4ef2a5d0799b460b548de256c4f81063d720afe3f68c9dcdb3a7192ae1
SHA5128633dfd239c5d416211b1647d87f946a30f4b9c8dad2c538da3f8c64f6c269f2c86ac49277a663e1a0033ff50a4f13d2d7d69180bdba1c5be01e5316d6eed189
-
Filesize
400B
MD5a27d582d9ae6add1887b623f6949fe69
SHA1368fcb94a67ede669ae34d3b220f5a11acadc3b7
SHA25670d9228adb078937c9727fc194656b50e7807b4bf131f4ac8b623dc1347e79dc
SHA5124dd48892fb828d2a7d66a680c64ee34f76117e5adeb924bd677af9c977723710e389c43a8313130073a2a755544f115ffd6783d65f9b7bbdbcdbaaecef8193ed
-
Filesize
135B
MD5d7627f536a1fb455be05bc121a0b7ac0
SHA1b02e4b7ade8c3de597d4852e953aaa1940abe5f8
SHA2561c1a1241ca67d073394add7774b6d2bf229f9baaaaba38cad365d3d0fb1ff68d
SHA5125d41c74b9feb3469a1b82a77a5d63281f49fe9db1c3805a4d6873d7c1f5c01166b60011c539b88e2f9cbff36775db7d244a86b7fd584ffae96113bd6ed64604c
-
Filesize
135B
MD5947dd42910443f58f9bdb0915455ba22
SHA1c65f052b03b96f28f3768a46c26ba34e0c620c28
SHA25688acb5587f6a3d96b93537436a564e17383bff8d9d7e4c734e4a9355a94a25b2
SHA5128a5b67d3e1484ad3e84ff8272117c754a1ffef9d71347a49902f3f27c65764df4b05c6034fdf3df1d1961bdb9f0110cfcaf43cf90fd02ecd60a5f1895afacf51
-
Filesize
93B
MD52752bcf88f2713ddc6b0ea73df49a590
SHA1a41ef55d1fe52fde914b818ad83eed2994060ca0
SHA2569f137b2b607c5bad0ed9d8c14de632f20c26fe3d545059cc3fa1bfa0c1547e4b
SHA512d22274bff256f153bf0179ce4432740e503cb24c236c7e75f24f135e4db659868b6c3a594c697fa945c3b4339cbd575939a5dd6e621ecfd4ba449c9e5947f5e2
-
Filesize
93B
MD504a144f64d726bd213d017323794ce16
SHA1a7811d03e6ace78075b39a80871fe224c6abc73e
SHA2564ca53f76e7c30947e89e88b56ef60b612146cde78e95356f3a56fded107972eb
SHA512b099cfc6446fa4bc7479787511f5c7dd225277662eca2f7893740c92b6b9f8ae1f125d8f85a3f7ee12900b0d641507eec214765feb8bf0766f0a57ee6e65a45b
-
Filesize
73B
MD57025073fa36676495e27db63fe5e79d8
SHA1f2adb1d32c53af53b1663e4b58ebdff70622d2d3
SHA256a980560cf839773238353ca7f1dfa1fa7d6df5b5e8738e0671510cec8fcdfba5
SHA51225330a16eabad2a1e7957c07e03f3fc9174e9180a1145b8f1761e31b6af58e0ae4a432ada97cf7b145d1d70297cf68daee007da1c29c5b9d1f80d53bd4733b7a
-
Filesize
73B
MD5d02c4392e722aef6e60246deec7643f7
SHA1dba5860ab4231a3b159229be595a1a61a075f78b
SHA25660300852d766d3a7692e4141e2f713e4f802a8a49d51953d96e4d17c23b7f3ed
SHA51297289b44aa17e8f870434b965baa082fd80515acb1d19fd8178188fb8ee510276f33ff8adf9cbe18094dfe22afb681c82eec3071f487c6c84214e44127141267
-
Filesize
247B
MD586a78e2b4c7088d2c3b4d56f14686d92
SHA1ca7ba454a065c5a238f54ba8435f1f83bc4a4ffd
SHA2564efcfcebca6b75d91e7c255e5b9ef9a28d9edcb8d059ed4350d28c0f1bfaca7f
SHA512fe089be0799e0c10ee2c297267f76d032915407b5012d7c883f9ca344ce3628336cf184a784c42b02c3c288ca02ac090d55cbaf30dc4d5f2206f0fd90057e987
-
Filesize
249B
MD557ae0a372c39425dfddc49ac5b06995b
SHA1f9a289544dc6c7b7b26a2c2285b1be0e7e92da21
SHA256a1f5ff92994e8402b6022430a4a3a5e5033674d118017a5fd7d17292175c9d2f
SHA512d268be5adc29bd64b2577283fbd9c113e272da9375f5cf186617c1b03aac38db2bde2016559076c24a7d3d2070266d9e62a1a6fbaf1ec5c5de7005b3827cf1e6
-
Filesize
279B
MD51b328ce6c89df59a86ff15fca7afd001
SHA1057fcc69f6950e8ac0d66005c41c489475625d26
SHA256947efcea4dfd2af854737936aae74285cb2d8acd0f9cffa9cd3884b2d9938593
SHA512c71598769a5cc7166e4339c4556f8090ef04ff8059e8348611098b158a2d1cb4c647b27ea69ac3306732a0bbc4aa79f043266ec04fcf82cfc246b8f251292781
-
Filesize
646B
MD53663555db1853cedff3667d99e61012c
SHA1c3fbcb27bebdc65a58af07fac28fa840d6aef208
SHA256c18e53965d8c425f67ffd4bdef0f7f88df30170502f299ef39acac3b4ed5c945
SHA512f256b798fc3a082278bd835c3162ec03fcc5c9093e2229e9f375c6bfe9c97132e1a6c80869a8517726f37a531d6010aff307903ba74e7f5e566e1729067f7538
-
Filesize
648B
MD56e7c50b964772490d2cac40c5024b618
SHA1d4408be3a3fc91c389869e9d95dc3a3e448e5b5b
SHA25604400da00bd1f8ddfb75f19dcc43624e82074d6650b72680ff8ded878f12af21
SHA512197ebfe46f6a3a87a10a41feba4a4027ef9476a5684053c61f115cf5b3d39e037fb03fa4bd795d710d92b6d3698c0d559fa6c31b49c5220fb5c386403245c106
-
Filesize
82B
MD555d09f967ef48453577823f1d9df08f2
SHA101c24c7748e62ab2ba1c100c72e26eb517e00737
SHA256e477d934fd7b54e2cbf69a0aa0b056b2bac8a008a2d6e2a658e7c8413c3b9284
SHA5124ead07b555acf92da95641d9d2198c1cf5cc588d628e67fd25ed9179785c67fb73d35349ebaf897a05e927c2df3ef0fdd079c09f248753aafc6bf3921117ee6c
-
Filesize
81B
MD5e0cdcbf5efcacf5e91b02ee2efc424ca
SHA166548803f51a35201058c5efbedbdcc68823c98e
SHA25624e58192853aea879fa8bacf0b65bee506dc7b9690a1894fe5a6031d745e9f91
SHA5121ac0dd500fdeae50a4c8ae6babd77eaf057cd09185dc2457084f7fe508c68fbba7fa49f023b1881e82f82777f4fa9b57ca6a2bb24e67db44483cfbb226301c81
-
Filesize
267B
MD5c56f637081001c22b2f0295163462c54
SHA111810772503b1305903bd9d555ada98c65c72b73
SHA2562a78788d135f0c2068e2e50850fc148816c6f4ac8045fd77fd64209ee09b412f
SHA51292509072a4a1c9a62d77b1e29863e08c221f70716e94933aa9db097bf058ce1d08733cba47b0d51e1268c3ab91a3fb06f8cbb6634244309aafdf10c444e2c143
-
Filesize
267B
MD5d5060cf8876c2cc8a0adfa4be020cac4
SHA1d0baa3462b328f997238a6bce188feaeac73fb31
SHA256248314bf2cd07e332cce9ddf4c0a8521eac6a5dc5b6f9e66247ef73cb465f69d
SHA5126a4198278dddf52ffcdc1bfcd40420f3c7546509e08a4ebfb2297879953b653efadc9b44a7055d76812c47b0b0d361f78bf625bffb6b177f882d832f7678dc49
-
Filesize
267B
MD51e65b36334cdd742b9dd7bba22345a00
SHA118d68ddd61ea295d4ade1dfaee6f18eaac0c3a57
SHA256dd4f1ed1903180e1b6bac336a7ddfb291aca2d87959ac51c9529bdc4f245cf0b
SHA51205df91e773e63ecf36531199d372916c32442ab42eb53e1cd22a7a0feabf7d6c3396731f45ec3cbfaebc2504ac3cc1bfffdde78342fd86896d86cc147c758a9b
-
Filesize
267B
MD51b1adeed51f14cda879f631217b73a6d
SHA1d2e7f593afaceeaa18668a93a30ec95e97d68c38
SHA256671678524613c3a047bb0f6cebb089a55688af8ee061f46ceefdfcacdd005672
SHA51258d350326f15f6489ac1e3baa60a5d7c16de87eec28e2d90a80b6f75ab5642f2ea90bf36f5b0a0a26a1f16676ec68cd820c98ef51b34bc4154519d3e0399cbb7
-
Filesize
270B
MD56985858f7479b926e99f0d573691c3ab
SHA1a4636ca373feacea029fe636c76e15e778e64d66
SHA256a41c4b8deabe3c095d1ae817f8ad198fe1518ec87d6c9f49e5485995895003f3
SHA5120bd59e8246459ee9a50f082a735df0a72a1edb3958210533d1645edf8aa366c6952e0d5061804a66351659691fe7062bc5d350307b06b877b2d566fa515a4ebc
-
Filesize
270B
MD5147add4ca4a6a88d53cf90b57ff2b444
SHA190ce7b5978764c2423fd359104bfcd4503894669
SHA256434939656b61ae90ac23d98df5b4f829f12b9e866a337ef1b9afe06a7e01884b
SHA512eac21001cfeef7a4335e5e5aced741a65d9b292bfbc10965d0be97bd9257bd18acd567acdbe5a30b1d0e242fb5fa3fc5d650235c7dc33b451c6c45c04f9eb326
-
Filesize
270B
MD53af70dfc3dfe057cd3e0e5d93e6cbbfa
SHA1ebaf73963761e6b6e732d1d1e1876e3490e46d6d
SHA2565efc27deae347d11c539f87b69a124a9c8e55a660c81bafe3cc7d50aab20feef
SHA5123f908abfbdf548ddd30118d04ccec91424b877aa323568f4e1e668cafa99177e6aa2e7a280fcb8317f41a1dc6eb4afba0a5330049bd107bd7e7135b1b121a6c6
-
Filesize
270B
MD50107e0ecaf2db643df361693c694b17f
SHA1942326aa7f886e3050ec7c3b3ba285f95667356d
SHA2564ad6be088e27c5b1e14a88b34fa6829c2d2c1e25042cc2387174e621b9841bfc
SHA5129392d0f953e8045105267b7def94c4c16d59af8856c948e5d16ff8dfe482196c3965f4c764326a30da026646f6abe9b91ac3168173e71dc4c1aa376c7ac8ecc8
-
Filesize
191B
MD5466ebfcd19bb096317ff37606a567a0b
SHA10e884ec6923a8e33239abd90e780785be059d3bf
SHA256836cc2cd80164ed47a44ed8c44d8d0e6bb11214ab528b4463aa055251ada704b
SHA51237d42df8d478b2a7ee892c93bdb92d27e3788af1a1bbae870f40355e9b6cb2c01a41b2b4edb7525d116c640ce28bc99caf9ba592cf042f46043a155c68d1942d
-
Filesize
186B
MD5e4882e760b3a00b55335d95494f10b0d
SHA1e7c76ea0673587374b7e2d4ebb6bf8ee4e0f7e7f
SHA2563cedb0996a6de50802d9f399ce074f76f8f8e56bfd9092c3409a828021d83351
SHA512dbc8ca68f0f40608413b6ca63a8cce1476c8fb170a1dd92dfc421c5654b02da8e02d94b2304791332d08684160c9f3c89ca6f52184dc9127869ef58645367eb8
-
Filesize
190B
MD5c64b71fe3069bfef9d386b051369119b
SHA1f67b2646f7142a9320084ab40ccb614407f2a8f7
SHA256ddba52fa6fee33b8ee7a150625f392097198b718afc76c47a4280e5af8774876
SHA512d79c3d96baa21b1337aa8dd5f202a6a69243bc396a11571a6194781619293bdf34959aae5566a684ec93d852f5251cb6f94bed18bba30121ca1a3a87a6ed5a71
-
Filesize
187B
MD531295d215a5ed1435644ab0ed19defd8
SHA10dc209ae35e629324a23624e3bd060fdd8bc7f31
SHA2560b21801a201caf28ea2070ca0d2fdb28705555c90d36cd12f374aa4c3c8803ce
SHA5122d94ac696cbb7a322d3c8cdd113ba3b9c3323e20de6ee9b2f1465cb47561bf7afd149e097cbec73af8c71075ce768fab313d6f87d116f6af14a5c630a89b5526
-
Filesize
200B
MD5ec25c9d7872013297d67e70270483b78
SHA11ec584594a922f228d70e2c918090334ee260ee7
SHA256343c64fbc7035f18685fd5f868b7c140347c9dde2d104400d6f06e3f080432dc
SHA5127668e4868808bed40917cb785c66a788b9bbb30a95b6a9539a825ae01a11671c909d6f85fad7e1cb5330706c3e95bee839e017666ca06473a8f22c93926c7e2d
-
Filesize
200B
MD51be423deaaa1894507b2b2e9e0aef167
SHA19c6c6429da4bd493dab4feaacd1a9bcb0a5cf34f
SHA2562ae1aa3d220693aa4fa324d388c82fab0e9a8d6496b9498d37f6a233da092e63
SHA512984b4e9f84f6160e85114364c88cea1d317e1c99669adb481783518946018bd8405a168e0067ff885e5df47ee28ac25997d7d226f9759f2e937ce8b57be58e86
-
Filesize
905B
MD548394cad9222fcf19d130a30d5f630dc
SHA12f63fff01644143d255b4614630a73a9317d0861
SHA2560a6d3bb3dda8b5e2147d02c4f3cbb19bda9c753e83e74fce8c1a557f802b1d5d
SHA5121014e31d4a3fb7ea85d3d555dfa9d87d80e60ef422fd4f1f6379c30ff1c1d40327833d2e173604b2801c6f2901b1570354aa6422537ce3617494a75284b5fa8e
-
Filesize
2KB
MD5068c97c6c8e124bc92f1bc75d98b8576
SHA1b403245714412ef38ccbd210d00e44ed668c74a3
SHA25671e39ef5d3e58f2f00fa1ea3bb0419cb5b447fc9ccd35f8e30fe2d88ee9d70f7
SHA5126998e7f5f95f3043b94dea0185db4ad1b5403884174462be7395d456920d3830773164c98d470df01cf51629a663b4d26bc8f67864077d9e891383ffb14fc73e
-
Filesize
4.3MB
MD511c051f93c922d6b6b4829772f27a5be
SHA142fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA2560eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
SHA5121cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6