8f761f519f3609aaee1112c39b1c516044b864e5ac02d253e5a99a0b76edc805

General

Target

9bed99bef99ca4bc16d547504521dc34.exe
Size

73KB
MD5

9bed99bef99ca4bc16d547504521dc34
SHA1

b098859272ac498347a16d46699ff2b6f5f4d11e
SHA256

8f761f519f3609aaee1112c39b1c516044b864e5ac02d253e5a99a0b76edc805
SHA512

ab1aea55ac9c4d19df4da4b0e3488bf0abee607b7ab9627c74860fd8e84af219fab81b12c43ecf4ce6a783a36917423bd33af6972ee37dc906b5a50f33f78441
SSDEEP

1536:yrD1NsjCcsLVxCOQjDQ0bXHfGn7GpQ/BQfqClL34Ro4TWKFlFej:m6jCcsLVsOQjDQ0DHfG7GarWL3CxqK/8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
612	wupdated.exe

Loads dropped DLL 4 IoCs

pid	Process
1088	9bed99bef99ca4bc16d547504521dc34.exe
612	wupdated.exe
612	wupdated.exe
612	wupdated.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wupdated.exe	9bed99bef99ca4bc16d547504521dc34.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe	9bed99bef99ca4bc16d547504521dc34.exe
File created	C:\Windows\SysWOW64\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	9bed99bef99ca4bc16d547504521dc34.exe
612	wupdated.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 612	1088	9bed99bef99ca4bc16d547504521dc34.exe	28
PID 1088 wrote to memory of 612	1088	9bed99bef99ca4bc16d547504521dc34.exe	28
PID 1088 wrote to memory of 612	1088	9bed99bef99ca4bc16d547504521dc34.exe	28
PID 1088 wrote to memory of 612	1088	9bed99bef99ca4bc16d547504521dc34.exe	28
PID 1088 wrote to memory of 612	1088	9bed99bef99ca4bc16d547504521dc34.exe	28
PID 1088 wrote to memory of 612	1088	9bed99bef99ca4bc16d547504521dc34.exe	28
PID 1088 wrote to memory of 612	1088	9bed99bef99ca4bc16d547504521dc34.exe	28

C:\Users\Admin\AppData\Local\Temp\9bed99bef99ca4bc16d547504521dc34.exe
"C:\Users\Admin\AppData\Local\Temp\9bed99bef99ca4bc16d547504521dc34.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\wupdated.exe
  C:\Windows\system32\wupdated.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wupdated.exe

Filesize
73KB

MD5
9bed99bef99ca4bc16d547504521dc34

SHA1
b098859272ac498347a16d46699ff2b6f5f4d11e

SHA256
8f761f519f3609aaee1112c39b1c516044b864e5ac02d253e5a99a0b76edc805

SHA512
ab1aea55ac9c4d19df4da4b0e3488bf0abee607b7ab9627c74860fd8e84af219fab81b12c43ecf4ce6a783a36917423bd33af6972ee37dc906b5a50f33f78441

Download Submit
memory/612-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1088-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing