8ae380d48785a309c2383b2a3dc43331b184e4cd9bb2bfe442cb22ce44410f3f

General

Target

23c41122b24ddeac2c92dfce3eb63579.exe
Size

73KB
MD5

23c41122b24ddeac2c92dfce3eb63579
SHA1

bcc31351f54ef86751af2e6a41db099f7a1d532b
SHA256

8ae380d48785a309c2383b2a3dc43331b184e4cd9bb2bfe442cb22ce44410f3f
SHA512

a80e8a728e65bc595ced1a25043f4f8ba4b4ec0f724dca2f38f2b0ef527e32619b5418c9bf53f1cf868fd9adc7e30239b3aacc4b42c7108a6063c52b01d6039f
SSDEEP

1536:kvH5fh/bcYsS0/L92vhPFgZQPFQpSj934Ro4TWUFlFej:IZ/bcYs3/Z2vhNgaMY93CxqU/Fej

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1484	wupdated.exe

Loads dropped DLL 4 IoCs

pid	Process
680	23c41122b24ddeac2c92dfce3eb63579.exe
1484	wupdated.exe
1484	wupdated.exe
1484	wupdated.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe	23c41122b24ddeac2c92dfce3eb63579.exe
File opened for modification	C:\Windows\SysWOW64\wupdated.exe	23c41122b24ddeac2c92dfce3eb63579.exe
File created	C:\Windows\SysWOW64\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
680	23c41122b24ddeac2c92dfce3eb63579.exe
1484	wupdated.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 1484	680	23c41122b24ddeac2c92dfce3eb63579.exe	28
PID 680 wrote to memory of 1484	680	23c41122b24ddeac2c92dfce3eb63579.exe	28
PID 680 wrote to memory of 1484	680	23c41122b24ddeac2c92dfce3eb63579.exe	28
PID 680 wrote to memory of 1484	680	23c41122b24ddeac2c92dfce3eb63579.exe	28
PID 680 wrote to memory of 1484	680	23c41122b24ddeac2c92dfce3eb63579.exe	28
PID 680 wrote to memory of 1484	680	23c41122b24ddeac2c92dfce3eb63579.exe	28
PID 680 wrote to memory of 1484	680	23c41122b24ddeac2c92dfce3eb63579.exe	28

C:\Users\Admin\AppData\Local\Temp\23c41122b24ddeac2c92dfce3eb63579.exe
"C:\Users\Admin\AppData\Local\Temp\23c41122b24ddeac2c92dfce3eb63579.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\wupdated.exe
  C:\Windows\system32\wupdated.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wupdated.exe

Filesize
73KB

MD5
23c41122b24ddeac2c92dfce3eb63579

SHA1
bcc31351f54ef86751af2e6a41db099f7a1d532b

SHA256
8ae380d48785a309c2383b2a3dc43331b184e4cd9bb2bfe442cb22ce44410f3f

SHA512
a80e8a728e65bc595ced1a25043f4f8ba4b4ec0f724dca2f38f2b0ef527e32619b5418c9bf53f1cf868fd9adc7e30239b3aacc4b42c7108a6063c52b01d6039f

Download Submit
memory/680-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1484-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing