1a5e45f203a2da83dddf6573eb82965d867770219d2cbea8636a93707f4ccdab

General

Target

35ed51a7de2693e364d83c94b76c58ee.exe
Size

209KB
MD5

35ed51a7de2693e364d83c94b76c58ee
SHA1

a9246afc1f52575459a0fbf754018c702e1a18e0
SHA256

1a5e45f203a2da83dddf6573eb82965d867770219d2cbea8636a93707f4ccdab
SHA512

0884c5191c650b385763e5256423f16b5a961619075e0572406ec4e284eda2fd101f28cf8377ab50efc8f06cd718b19ee94f932098c1b8f36ee8b35ed7911a17
SSDEEP

6144:hl0n6au4QpDsdprlPwnRB/+3I7+rXh0uCI40Su:Yn6auBpDeprlPkRB/tujNV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2168	u.dll
2788	mpress.exe
2620	u.dll

Loads dropped DLL 6 IoCs

pid	Process
2196	cmd.exe
2196	cmd.exe
2168	u.dll
2168	u.dll
2196	cmd.exe
2196	cmd.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2196	1732	35ed51a7de2693e364d83c94b76c58ee.exe	29
PID 1732 wrote to memory of 2196	1732	35ed51a7de2693e364d83c94b76c58ee.exe	29
PID 1732 wrote to memory of 2196	1732	35ed51a7de2693e364d83c94b76c58ee.exe	29
PID 1732 wrote to memory of 2196	1732	35ed51a7de2693e364d83c94b76c58ee.exe	29
PID 2196 wrote to memory of 2168	2196	cmd.exe	30
PID 2196 wrote to memory of 2168	2196	cmd.exe	30
PID 2196 wrote to memory of 2168	2196	cmd.exe	30
PID 2196 wrote to memory of 2168	2196	cmd.exe	30
PID 2168 wrote to memory of 2788	2168	u.dll	31
PID 2168 wrote to memory of 2788	2168	u.dll	31
PID 2168 wrote to memory of 2788	2168	u.dll	31
PID 2168 wrote to memory of 2788	2168	u.dll	31
PID 2196 wrote to memory of 2620	2196	cmd.exe	32
PID 2196 wrote to memory of 2620	2196	cmd.exe	32
PID 2196 wrote to memory of 2620	2196	cmd.exe	32
PID 2196 wrote to memory of 2620	2196	cmd.exe	32
PID 2196 wrote to memory of 2944	2196	cmd.exe	33
PID 2196 wrote to memory of 2944	2196	cmd.exe	33
PID 2196 wrote to memory of 2944	2196	cmd.exe	33
PID 2196 wrote to memory of 2944	2196	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\35ed51a7de2693e364d83c94b76c58ee.exe
"C:\Users\Admin\AppData\Local\Temp\35ed51a7de2693e364d83c94b76c58ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\3E29.tmp\vir.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save 35ed51a7de2693e364d83c94b76c58ee.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\3F51.tmp\mpress.exe
      "C:\Users\Admin\AppData\Local\Temp\3F51.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe3F52.tmp"
      4⤵
      Executes dropped EXE
      PID:2788
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    PID:2620
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3E29.tmp\vir.bat

Filesize
1KB

MD5
9f8022a402f31986dda1140d01453c69

SHA1
870211d6d62db9edf9bf9345c3d7eea1b1f5fb72

SHA256
73dc9856fb8aa4f23f9d0d68c0fc6c2fe2fbf9b28085db096445802cebf1e005

SHA512
4adf1ed7c8e142d3464af7a24b982def76e1e249a75622917e6686f8ccc832f0811a1cd56e8c8bebaefd4e575e9d1b9879c1f66c7e44b18430b57fd4e68b2295

Download Submit
C:\Users\Admin\AppData\Local\Temp\exe3F52.tmp

Filesize
41KB

MD5
7aa367dca7be65e07b16bd69f06263e3

SHA1
d447739251408f8e8490a9d307927bfbe41737ce

SHA256
738bf50547320b0683af727ad6d430f2e7b83c846fe24f91527b7ee263bfa076

SHA512
d7884589d7d12a628c9e07b77b3b793fa91f67fe13563e7b072ca864e053e6b7d711852e30ae1c877576b8ad47f67d2826e8ee711e6b65a329baa57492fe31b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\exe3F52.tmp

Filesize
41KB

MD5
02715a4b432f3804e8e071e403bc20bb

SHA1
e9f78fec93c6bab25fde6f1e428451c1d72680a4

SHA256
c32141e78c6b89fc670ce80893be58e270a10e37aace8819021468e5415a5aad

SHA512
fbafe6e5226a5b00a0f8531a8f22a3e3aabcaefff9d048721c2efe198ea2f31dc74c8a5cc60e2a67db50059d0ab53244b7c92b8fef898b17a7feaca5ddc7f3f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\exe3F52.tmp

Filesize
24KB

MD5
d4cc8079170c36bc2ed96932abce3ae1

SHA1
a9d6947389e98106859e656da214ae9f53757946

SHA256
3f25abd11cecf55b92ef59c4d806a5f8d325d01eb63d8520c7fb6f424ff36d7b

SHA512
0ff6b44d497c56dad1d5fe0df3d9a8cd64c6e1fb4e88d8c0e77aeb67082d6d21a92478c759cb8a03c8b478aec3b9f4d3b7ff6e58c83bb776609e6310f362ae27

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.dll

Filesize
700KB

MD5
3c9568b0d86a865f9f73d9c0967cfdad

SHA1
3270df3e0e600f4df2c3cbc384837693a8a3a83e

SHA256
c7b97a001b39e17382e929aad924555f3d21886b86aed38cffd660490801d1d6

SHA512
bd423d1d57823b1bf6db42aeec199aa93178a9317ead85b42b60e091aaf4f73ce721bc07fda4750e112c4dccb9d87e21d5793965da9d6e92b0c5bed92c26876f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir.bat

Filesize
1KB

MD5
f9a47076184f3461ebbc9be4da3507b5

SHA1
4ced35d4c22e3161ad81aa6ba03be08a0d6705e6

SHA256
8dd3a203377ca9478597502b621fb9db51efe3cd1ca95525bf905683a02c4056

SHA512
87d919fc63c0029210fef611a3d0fefcfcd1b105c9e2318f8e332edafbf1e8a9403e4f93b1ab32e1cea9b913404fba2a21493e27883804671b78e738aa9081f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir.bat

Filesize
1KB

MD5
8c94af8de9381155ce84771a6d793bbd

SHA1
bfe181274965e41ec3b4f686ca792a4d38ec84cb

SHA256
60aa0bad5ece227162994fca2352a0df6c0b03cf729aec055d830532fff77c5f

SHA512
b9d79b5962a490182035bf997474586c855885d0f746c3682401670c72956a135f78f667c4e82101f95156474df26265226d0ea5b3e18471470cf778747809b2

Download Submit
\Users\Admin\AppData\Local\Temp\3F51.tmp\mpress.exe

Filesize
100KB

MD5
e42b81b9636152c78ba480c1c47d3c7f

SHA1
66a2fca3925428ee91ad9df5b76b90b34d28e0f8

SHA256
7c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2

SHA512
4b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e

Download Submit
memory/1732-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1732-113-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2168-66-0x0000000000830000-0x0000000000864000-memory.dmp

Filesize
208KB

Download
memory/2168-69-0x0000000000830000-0x0000000000864000-memory.dmp

Filesize
208KB

Download
memory/2788-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2788-75-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads