de8869cf9b1e4881596e9b4a9cb6351228260dc42ebf0a91ec471f4e26b0d2ec

General

Target

PO SUNS788.exe
Size

1.4MB
MD5

0230103d88fc4446732570869056cb82
SHA1

4ac4e34c9a80d5ca6e65c0a711e1b9f00dbb2d13
SHA256

de8869cf9b1e4881596e9b4a9cb6351228260dc42ebf0a91ec471f4e26b0d2ec
SHA512

8530cb687173d8d567d45fc18c1326b677206f34277a8559fcf9e16ede69ddd06cac9b7ef3495653c8affea005c5132ab5aa784a4d1bb06b7af9ce1edc635a77
SSDEEP

12288:awx4PnhWEl8Iq+alkg0KvPOoBH82T9A7nnH/X/Yzdc/Z77yRdkBBB:ZCoEJq+a50EPOoBjMfv5/ZCi

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 2768	1708	PO SUNS788.exe	28
PID 2768 set thread context of 1388	2768	PO SUNS788.exe	9
PID 2768 set thread context of 2892	2768	PO SUNS788.exe	32
PID 2892 set thread context of 1388	2892	newdev.exe	9

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2768	PO SUNS788.exe
2768	PO SUNS788.exe
2768	PO SUNS788.exe
2768	PO SUNS788.exe
2768	PO SUNS788.exe
2768	PO SUNS788.exe
2768	PO SUNS788.exe
2768	PO SUNS788.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe
2892	newdev.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2768	PO SUNS788.exe
1388	Explorer.EXE
1388	Explorer.EXE
2892	newdev.exe
2892	newdev.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2768	1708	PO SUNS788.exe	28
PID 1708 wrote to memory of 2768	1708	PO SUNS788.exe	28
PID 1708 wrote to memory of 2768	1708	PO SUNS788.exe	28
PID 1708 wrote to memory of 2768	1708	PO SUNS788.exe	28
PID 1708 wrote to memory of 2768	1708	PO SUNS788.exe	28
PID 1708 wrote to memory of 2768	1708	PO SUNS788.exe	28
PID 1708 wrote to memory of 2768	1708	PO SUNS788.exe	28
PID 1388 wrote to memory of 2892	1388	Explorer.EXE	32
PID 1388 wrote to memory of 2892	1388	Explorer.EXE	32
PID 1388 wrote to memory of 2892	1388	Explorer.EXE	32
PID 1388 wrote to memory of 2892	1388	Explorer.EXE	32
PID 1388 wrote to memory of 2892	1388	Explorer.EXE	32
PID 1388 wrote to memory of 2892	1388	Explorer.EXE	32
PID 1388 wrote to memory of 2892	1388	Explorer.EXE	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\PO SUNS788.exe
  "C:\Users\Admin\AppData\Local\Temp\PO SUNS788.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\PO SUNS788.exe
    "C:\Users\Admin\AppData\Local\Temp\PO SUNS788.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2768
- C:\Windows\SysWOW64\srdelayed.exe
  "C:\Windows\SysWOW64\srdelayed.exe"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\newdev.exe
  "C:\Windows\SysWOW64\newdev.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-29-0x0000000008840000-0x000000000B6EB000-memory.dmp

Filesize
46.7MB

Download
memory/1388-21-0x0000000008840000-0x000000000B6EB000-memory.dmp

Filesize
46.7MB

Download
memory/1388-20-0x0000000003C10000-0x0000000003E10000-memory.dmp

Filesize
2.0MB

Download
memory/1708-13-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-1-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-2-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download
memory/1708-3-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1708-4-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/1708-5-0x0000000005220000-0x000000000529E000-memory.dmp

Filesize
504KB

Download
memory/1708-6-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-7-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download
memory/1708-0-0x0000000000CB0000-0x0000000000E1A000-memory.dmp

Filesize
1.4MB

Download
memory/2768-15-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download
memory/2768-25-0x0000000000310000-0x000000000032D000-memory.dmp

Filesize
116KB

Download
memory/2768-12-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-17-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2768-19-0x0000000000310000-0x000000000032D000-memory.dmp

Filesize
116KB

Download
memory/2768-9-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-8-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-24-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2892-22-0x00000000000D0000-0x000000000010C000-memory.dmp

Filesize
240KB

Download
memory/2892-26-0x0000000001FA0000-0x00000000022A3000-memory.dmp

Filesize
3.0MB

Download
memory/2892-27-0x00000000000D0000-0x000000000010C000-memory.dmp

Filesize
240KB

Download
memory/2892-28-0x0000000001EB0000-0x0000000001F4C000-memory.dmp

Filesize
624KB

Download
memory/2892-23-0x00000000000D0000-0x000000000010C000-memory.dmp

Filesize
240KB

Download
memory/2892-30-0x00000000000D0000-0x000000000010C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing