d95bfe5461ae5ac68688d2cb11c8b74ff827441c3efa326e33ea439247507df8

General

Target

52dfd3a9f74ff32963538295fcecd780.exe
Size

1.8MB
MD5

52dfd3a9f74ff32963538295fcecd780
SHA1

0f990ce98d458f4b57d9ad23fb30045b1a0120c5
SHA256

d95bfe5461ae5ac68688d2cb11c8b74ff827441c3efa326e33ea439247507df8
SHA512

4384ad2832d44c6fb665c482cc91a44cbb7287c4f750d9df46bbb6b48cf6ba5f4eaef079048cbc1288f4218797529430d550b498752d41637dbd62e70221e292
SSDEEP

49152:B0e6ZrIhl8UnrSU1ipSMcV9cRlyqZ2RqWeq8DFOaaM9tBa:W1VIhP30pS3RqWv8DxJ9na

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4812	360O0K.exe
3368	360O0K.exe

Loads dropped DLL 2 IoCs

pid	Process
2468	52dfd3a9f74ff32963538295fcecd780.exe
4812	360O0K.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\360O0K.exe	52dfd3a9f74ff32963538295fcecd780.exe
File created	C:\Windows\SysWOW64\360O0K.exe	360O0K.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	360O0K.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	52dfd3a9f74ff32963538295fcecd780.exe
File created	C:\Windows\SysWOW64\360O0K.exe	52dfd3a9f74ff32963538295fcecd780.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2468	52dfd3a9f74ff32963538295fcecd780.exe
2468	52dfd3a9f74ff32963538295fcecd780.exe
2468	52dfd3a9f74ff32963538295fcecd780.exe
2468	52dfd3a9f74ff32963538295fcecd780.exe
2468	52dfd3a9f74ff32963538295fcecd780.exe
4812	360O0K.exe
4812	360O0K.exe
4812	360O0K.exe
2468	52dfd3a9f74ff32963538295fcecd780.exe
2468	52dfd3a9f74ff32963538295fcecd780.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2256	2468	52dfd3a9f74ff32963538295fcecd780.exe	95
PID 2468 wrote to memory of 2256	2468	52dfd3a9f74ff32963538295fcecd780.exe	95
PID 2468 wrote to memory of 2256	2468	52dfd3a9f74ff32963538295fcecd780.exe	95
PID 4812 wrote to memory of 3368	4812	360O0K.exe	99
PID 4812 wrote to memory of 3368	4812	360O0K.exe	99
PID 4812 wrote to memory of 3368	4812	360O0K.exe	99
PID 4812 wrote to memory of 4952	4812	360O0K.exe	102
PID 4812 wrote to memory of 4952	4812	360O0K.exe	102
PID 4812 wrote to memory of 4952	4812	360O0K.exe	102
PID 2468 wrote to memory of 2696	2468	52dfd3a9f74ff32963538295fcecd780.exe	105
PID 2468 wrote to memory of 2696	2468	52dfd3a9f74ff32963538295fcecd780.exe	105
PID 2468 wrote to memory of 2696	2468	52dfd3a9f74ff32963538295fcecd780.exe	105

C:\Users\Admin\AppData\Local\Temp\52dfd3a9f74ff32963538295fcecd780.exe
"C:\Users\Admin\AppData\Local\Temp\52dfd3a9f74ff32963538295fcecd780.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\52dfd3a9f74ff32963538295fcecd780.exe
  "C:\Users\Admin\AppData\Local\Temp\52dfd3a9f74ff32963538295fcecd780.exe"
  2⤵
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:2696

C:\Windows\SysWOW64\360O0K.exe
C:\Windows\SysWOW64\360O0K.exe -NetSata
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\360O0K.exe
  "C:\Windows\SysWOW64\360O0K.exe"
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SE6206.tmp

Filesize
1024B

MD5
12871388b682b159ddd85545302a289d

SHA1
76b47377da188fcfddeefa0f940287f1cce9885d

SHA256
cc033f00e96cae1829e3a5c15150fe68a62f65440f1b158d9257370fbc488a9b

SHA512
d60953b62d08e52fa2860db257e2bdbaa97e7eff7007617857f7b30a76f7c7ba81f8444d313a6ad496adbbaede5af1661e72522046789bb9aee1340f7ac12c7d

Download Submit
memory/2468-7424-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-7426-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2468-2789-0x00000000025D0000-0x000000000277D000-memory.dmp

Filesize
1.7MB

Download
memory/2468-5354-0x0000000075C70000-0x0000000075CEA000-memory.dmp

Filesize
488KB

Download
memory/2468-7423-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-14853-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-7425-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-2790-0x0000000075AD0000-0x0000000075C70000-memory.dmp

Filesize
1.6MB

Download
memory/2468-7422-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-7421-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-3-0x00000000753B0000-0x00000000755C5000-memory.dmp

Filesize
2.1MB

Download
memory/2468-0-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-14865-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/2468-14862-0x00000000025D0000-0x000000000277D000-memory.dmp

Filesize
1.7MB

Download
memory/4812-7432-0x00000000753B0000-0x00000000755C5000-memory.dmp

Filesize
2.1MB

Download
memory/4812-14851-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/4812-12783-0x0000000075C70000-0x0000000075CEA000-memory.dmp

Filesize
488KB

Download
memory/4812-14855-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/4812-14854-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/4812-14852-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/4812-14856-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/4812-14857-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/4812-14860-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/4812-10217-0x0000000001240000-0x00000000013EB000-memory.dmp

Filesize
1.7MB

Download
memory/4812-10219-0x0000000075AD0000-0x0000000075C70000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing