a5bcbdcb63aed42716bfdbb33703c76854f24c59f6c5806229021276b90fe82e

General

Target

191c62976bc319120ed11f4c2eefd1e4.exe
Size

43KB
MD5

191c62976bc319120ed11f4c2eefd1e4
SHA1

9a83a94b2141440f6796ec1e895fe42a9d2700a9
SHA256

a5bcbdcb63aed42716bfdbb33703c76854f24c59f6c5806229021276b90fe82e
SHA512

10e76a054545004b603fa79dab90e58b3659b63b67e3fa68cb9644ff9e1a1fdd2d708c8ad1b0022aac5b3a11116e13cd8d9ab64b50d7100a4be05d7d3f18d0ed
SSDEEP

768:CfS/u738s4dCVfCkp++oKfxX+RtyO730MjhZAaY20P2sAmrzyr6l1PAmb:Cf2w8s4MhjkUxvWN1uaqIMPAy

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2064	jahjah23.exe

Executes dropped EXE 2 IoCs

pid	Process
2064	jahjah23.exe
2548	jahjah23.exe

Loads dropped DLL 5 IoCs

pid	Process
2264	191c62976bc319120ed11f4c2eefd1e4.exe
2264	191c62976bc319120ed11f4c2eefd1e4.exe
2064	jahjah23.exe
2548	jahjah23.exe
2548	jahjah23.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-9-0x0000000000400000-0x000000000061C000-memory.dmp	upx
behavioral1/memory/2264-17-0x0000000000400000-0x000000000061C000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jahjah23.exe	191c62976bc319120ed11f4c2eefd1e4.exe
File opened for modification	C:\Windows\SysWOW64\jahjah23.exe	191c62976bc319120ed11f4c2eefd1e4.exe
File opened for modification	C:\Windows\SysWOW64\mgt23005.ocx	191c62976bc319120ed11f4c2eefd1e4.exe
File opened for modification	C:\Windows\SysWOW64\mgt99018.ocx	191c62976bc319120ed11f4c2eefd1e4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fonts\mgt23005.ttf	191c62976bc319120ed11f4c2eefd1e4.exe
File opened for modification	C:\Windows\fonts\mgt23005.ttf	191c62976bc319120ed11f4c2eefd1e4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2264	191c62976bc319120ed11f4c2eefd1e4.exe
2064	jahjah23.exe
2064	jahjah23.exe
2064	jahjah23.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1196	2264	191c62976bc319120ed11f4c2eefd1e4.exe	7
PID 2264 wrote to memory of 2064	2264	191c62976bc319120ed11f4c2eefd1e4.exe	28
PID 2264 wrote to memory of 2064	2264	191c62976bc319120ed11f4c2eefd1e4.exe	28
PID 2264 wrote to memory of 2064	2264	191c62976bc319120ed11f4c2eefd1e4.exe	28
PID 2264 wrote to memory of 2064	2264	191c62976bc319120ed11f4c2eefd1e4.exe	28
PID 2264 wrote to memory of 2548	2264	191c62976bc319120ed11f4c2eefd1e4.exe	29
PID 2264 wrote to memory of 2548	2264	191c62976bc319120ed11f4c2eefd1e4.exe	29
PID 2264 wrote to memory of 2548	2264	191c62976bc319120ed11f4c2eefd1e4.exe	29
PID 2264 wrote to memory of 2548	2264	191c62976bc319120ed11f4c2eefd1e4.exe	29

C:\Users\Admin\AppData\Local\Temp\191c62976bc319120ed11f4c2eefd1e4.exe
"C:\Users\Admin\AppData\Local\Temp\191c62976bc319120ed11f4c2eefd1e4.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\jahjah23.exe
  C:\Windows\system32\jahjah23.exe C:\Windows\system32\mgt23005.ocx pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\191c62976bc319120ed11f4c2eefd1e4.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Windows\SysWOW64\jahjah23.exe
  C:\Windows\system32\jahjah23.exe C:\Windows\system32\mgt99018.ocx pfjieaoidjglkajd
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2548

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\07cachefiletttppp0F761A73.rtr

Filesize
16KB

MD5
5462f70e72d2984e9b715cc92421ce60

SHA1
283f3536076deb265d229e1a8a4b1b15ba7dd30e

SHA256
fd45517e06f2a29502f6e1c7706f50e553494a3509f31438d81d811b7abc10c0

SHA512
2507cb5362f11b4978b3b935e635a981682ba52dbd3f9df642da436b8694e06ff8613e2e1a6e3ce8b985d05736fa6a05f6bcb516da3b222132373a0ab9005f79

Download Submit
C:\Windows\fonts\mgt23005.ttf

Filesize
412B

MD5
23d2c3fb929f19bac804d129c3a536c4

SHA1
c59bd8261bf347541452a510e36eb4a43d11431a

SHA256
b5e1a59a01f3752a973e30d668b521f69ddbe973330d99824dd5be003f1f47f7

SHA512
d32c7f4e9ba99ee014acb812fd1a2ef79ff96944169d95bb4b2eff2a28f8f7bbc8059d6d792a43f20d974ec56409e4215268ada98eadb6dac86b749099435607

Download Submit
\Windows\SysWOW64\jahjah23.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Windows\SysWOW64\mgt23005.ocx

Filesize
63KB

MD5
80b39760c9b8deba498b7ae161331391

SHA1
de36bb73efed523e278569c88f5a0c95d027fcd6

SHA256
e4b61652d6bac1b4bc946d3466475ca529f75679bc76b7b1bf54cf61f90384b2

SHA512
c31901eb9d30c8bf6bf83bd03b8b4de2aa85ca7e2a1dcc5bbe6e92572630db22090537cec877ae435938e0010775a8b0626c898bae8218a2e31900fc75e67fb4

Download Submit
memory/1196-8-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/2064-25-0x0000000010000000-0x000000001022E000-memory.dmp

Filesize
2.2MB

Download
memory/2264-9-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2264-17-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2548-31-0x0000000010000000-0x0000000010208000-memory.dmp

Filesize
2.0MB

Download
memory/2548-32-0x00000000020F0000-0x000000000231E000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing