8f761f519f3609aaee1112c39b1c516044b864e5ac02d253e5a99a0b76edc805

General

Target

9bed99bef99ca4bc16d547504521dc34.exe
Size

73KB
MD5

9bed99bef99ca4bc16d547504521dc34
SHA1

b098859272ac498347a16d46699ff2b6f5f4d11e
SHA256

8f761f519f3609aaee1112c39b1c516044b864e5ac02d253e5a99a0b76edc805
SHA512

ab1aea55ac9c4d19df4da4b0e3488bf0abee607b7ab9627c74860fd8e84af219fab81b12c43ecf4ce6a783a36917423bd33af6972ee37dc906b5a50f33f78441
SSDEEP

1536:yrD1NsjCcsLVxCOQjDQ0bXHfGn7GpQ/BQfqClL34Ro4TWKFlFej:m6jCcsLVsOQjDQ0DHfG7GarWL3CxqK/8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4092	wupdated.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wupdated.exe	9bed99bef99ca4bc16d547504521dc34.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File opened for modification	C:\Windows\SysWOW64\wupdated.exe	9bed99bef99ca4bc16d547504521dc34.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe
File created	C:\Windows\SysWOW64\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe\wupdated.exe	wupdated.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1000	4092	WerFault.exe	84
3980	4092	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4408	9bed99bef99ca4bc16d547504521dc34.exe
4408	9bed99bef99ca4bc16d547504521dc34.exe
4092	wupdated.exe
4092	wupdated.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4092	4408	9bed99bef99ca4bc16d547504521dc34.exe	84
PID 4408 wrote to memory of 4092	4408	9bed99bef99ca4bc16d547504521dc34.exe	84
PID 4408 wrote to memory of 4092	4408	9bed99bef99ca4bc16d547504521dc34.exe	84

C:\Users\Admin\AppData\Local\Temp\9bed99bef99ca4bc16d547504521dc34.exe
"C:\Users\Admin\AppData\Local\Temp\9bed99bef99ca4bc16d547504521dc34.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\wupdated.exe
  C:\Windows\system32\wupdated.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 1092
    3⤵
    - Program crash
    PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 1100
    3⤵
    - Program crash
    PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4092 -ip 4092
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4092 -ip 4092
1⤵
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wupdated.exe

Filesize
73KB

MD5
9bed99bef99ca4bc16d547504521dc34

SHA1
b098859272ac498347a16d46699ff2b6f5f4d11e

SHA256
8f761f519f3609aaee1112c39b1c516044b864e5ac02d253e5a99a0b76edc805

SHA512
ab1aea55ac9c4d19df4da4b0e3488bf0abee607b7ab9627c74860fd8e84af219fab81b12c43ecf4ce6a783a36917423bd33af6972ee37dc906b5a50f33f78441

Download Submit
memory/4092-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4408-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing