7baf64ac0690d77323acafcc9e02cafde6e365a770580580b851e06d4d8644dd

General

Target

53c255f14b5e6cee23ad734ac8fcd23c.exe
Size

209KB
MD5

53c255f14b5e6cee23ad734ac8fcd23c
SHA1

d19cc516c77540b39d5a377f4bf4b73fd6a14e67
SHA256

7baf64ac0690d77323acafcc9e02cafde6e365a770580580b851e06d4d8644dd
SHA512

86e168883be33b193a87c5ac604d8e194401af219cbdcb9cabae5c4cf7af8961f71f979e1806745e80dcc2fb1f7d4c9e3f806f3a0b5b54bebc28ac3f3f401379
SSDEEP

6144:xl0n6auUe3vwFcSoQXn0s6XQbm90pmrtV:on6aul4Fzn0DAbdIt

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1848	u.dll
3260	mpress.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1420	OpenWith.exe
2916	OpenWith.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1088	4664	53c255f14b5e6cee23ad734ac8fcd23c.exe	93
PID 4664 wrote to memory of 1088	4664	53c255f14b5e6cee23ad734ac8fcd23c.exe	93
PID 4664 wrote to memory of 1088	4664	53c255f14b5e6cee23ad734ac8fcd23c.exe	93
PID 1088 wrote to memory of 1848	1088	cmd.exe	94
PID 1088 wrote to memory of 1848	1088	cmd.exe	94
PID 1088 wrote to memory of 1848	1088	cmd.exe	94
PID 1848 wrote to memory of 3260	1848	u.dll	95
PID 1848 wrote to memory of 3260	1848	u.dll	95
PID 1848 wrote to memory of 3260	1848	u.dll	95
PID 1088 wrote to memory of 2344	1088	cmd.exe	96
PID 1088 wrote to memory of 2344	1088	cmd.exe	96
PID 1088 wrote to memory of 2344	1088	cmd.exe	96
PID 1088 wrote to memory of 968	1088	cmd.exe	98
PID 1088 wrote to memory of 968	1088	cmd.exe	98
PID 1088 wrote to memory of 968	1088	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\53c255f14b5e6cee23ad734ac8fcd23c.exe
"C:\Users\Admin\AppData\Local\Temp\53c255f14b5e6cee23ad734ac8fcd23c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B2B6.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save 53c255f14b5e6cee23ad734ac8fcd23c.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\B4AA.tmp\mpress.exe
      "C:\Users\Admin\AppData\Local\Temp\B4AA.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exeB4AB.tmp"
      4⤵
      Executes dropped EXE
      PID:3260
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    - Modifies registry class
    PID:2344
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    - Modifies registry class
    PID:968

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B2B6.tmp\vir.bat

Filesize
1KB

MD5
b89ee5bc7c2504a1cc8ba3735b4912d4

SHA1
9114e5c897433e6947350b5849109b2b6463f1cb

SHA256
a107fb81b5705f466239de181c1800425d3e030475b8602bb93f7b1a3d4d826c

SHA512
5f9bb08598ec3066b2c3038953a9d75b0492ffd4e4a62306b5e2a8de9225bfa85f03339eb40a3b846e5e5ffd1804eb032b2161ae2b279691e014ba19b4615fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp\mpress.exe

Filesize
100KB

MD5
e42b81b9636152c78ba480c1c47d3c7f

SHA1
66a2fca3925428ee91ad9df5b76b90b34d28e0f8

SHA256
7c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2

SHA512
4b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\exeB4AB.tmp

Filesize
41KB

MD5
7aa367dca7be65e07b16bd69f06263e3

SHA1
d447739251408f8e8490a9d307927bfbe41737ce

SHA256
738bf50547320b0683af727ad6d430f2e7b83c846fe24f91527b7ee263bfa076

SHA512
d7884589d7d12a628c9e07b77b3b793fa91f67fe13563e7b072ca864e053e6b7d711852e30ae1c877576b8ad47f67d2826e8ee711e6b65a329baa57492fe31b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\mprB630.tmp

Filesize
24KB

MD5
7cda353434725a4a3712954fd3ded290

SHA1
d8348e79d6bcee527743b126026367d700ddb436

SHA256
7e781837fa89a8ead0a14c14a7f2125a89bb7b33d2ccc358f6b8ad22924b5e86

SHA512
4ac257fe8e0772adc8aa1a2626153c473554c341c025959dd994100c43e2cec274e8a532e0c1b5c0ecdf463733d25a63767b995b731ce272b1c7a3ad0820b95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.dll

Filesize
700KB

MD5
3c9568b0d86a865f9f73d9c0967cfdad

SHA1
3270df3e0e600f4df2c3cbc384837693a8a3a83e

SHA256
c7b97a001b39e17382e929aad924555f3d21886b86aed38cffd660490801d1d6

SHA512
bd423d1d57823b1bf6db42aeec199aa93178a9317ead85b42b60e091aaf4f73ce721bc07fda4750e112c4dccb9d87e21d5793965da9d6e92b0c5bed92c26876f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir.bat

Filesize
1KB

MD5
e34c584f5ac2dea647c48aece7de9565

SHA1
be6db3d694803c908afcc386375e345a539bd180

SHA256
b170d9da4b6e0942c4c4beb02ca7c8e9b68742e32d11dd830f28e844dd9e4bcb

SHA512
040ed1ab2603054c64d8c119e8d6c2789a85356dc961e85d51fc4daf506cb6485226aa88ad74cb444ce9c9d3e8c34052dea0a8489db4dbfef47009637cab3473

Download Submit
memory/3260-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3260-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4664-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4664-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4664-71-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads