5411452626d6233d06eeee147f9aa3d99bc432fbb12b610cfcb2a41e0a1872e3

General

Target

d5d73ef7b54c7028c75a6a2543895683.exe
Size

209KB
MD5

d5d73ef7b54c7028c75a6a2543895683
SHA1

da90a0334978dc07bdc5feb0698e01c0d10b9472
SHA256

5411452626d6233d06eeee147f9aa3d99bc432fbb12b610cfcb2a41e0a1872e3
SHA512

ec29d678ff63574a986116e63609c84713002e8c91e1b9ec300de3c93be6bbf6865ea42b02865945cffd0b0f8296afa2f1d2b0f68bf1c40ca5e3e975a6bb2468
SSDEEP

6144:wl0n6auHvtAedmhSzGR2kUEsEgunwBzJyBE4+Rw:jn6auHv6l4S2kUEsEjwBVyBE3Rw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2656	u.dll
2388	mpress.exe
1692	u.dll

Loads dropped DLL 6 IoCs

pid	Process
2532	cmd.exe
2532	cmd.exe
2656	u.dll
2656	u.dll
2532	cmd.exe
2532	cmd.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2532	2156	d5d73ef7b54c7028c75a6a2543895683.exe	29
PID 2156 wrote to memory of 2532	2156	d5d73ef7b54c7028c75a6a2543895683.exe	29
PID 2156 wrote to memory of 2532	2156	d5d73ef7b54c7028c75a6a2543895683.exe	29
PID 2156 wrote to memory of 2532	2156	d5d73ef7b54c7028c75a6a2543895683.exe	29
PID 2532 wrote to memory of 2656	2532	cmd.exe	30
PID 2532 wrote to memory of 2656	2532	cmd.exe	30
PID 2532 wrote to memory of 2656	2532	cmd.exe	30
PID 2532 wrote to memory of 2656	2532	cmd.exe	30
PID 2656 wrote to memory of 2388	2656	u.dll	31
PID 2656 wrote to memory of 2388	2656	u.dll	31
PID 2656 wrote to memory of 2388	2656	u.dll	31
PID 2656 wrote to memory of 2388	2656	u.dll	31
PID 2532 wrote to memory of 1692	2532	cmd.exe	32
PID 2532 wrote to memory of 1692	2532	cmd.exe	32
PID 2532 wrote to memory of 1692	2532	cmd.exe	32
PID 2532 wrote to memory of 1692	2532	cmd.exe	32
PID 2532 wrote to memory of 268	2532	cmd.exe	33
PID 2532 wrote to memory of 268	2532	cmd.exe	33
PID 2532 wrote to memory of 268	2532	cmd.exe	33
PID 2532 wrote to memory of 268	2532	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\d5d73ef7b54c7028c75a6a2543895683.exe
"C:\Users\Admin\AppData\Local\Temp\d5d73ef7b54c7028c75a6a2543895683.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\4E5E.tmp\vir.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save d5d73ef7b54c7028c75a6a2543895683.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\50A0.tmp\mpress.exe
      "C:\Users\Admin\AppData\Local\Temp\50A0.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe50A1.tmp"
      4⤵
      Executes dropped EXE
      PID:2388
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    PID:1692
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4E5E.tmp\vir.bat

Filesize
1KB

MD5
8ca74aa325e8054d6e94d2e4c16d49bc

SHA1
7934d42f41ecc30115011e51933794326363bc1d

SHA256
2653f5968b6883d57af922ef80eb44d1d0d8d7b3b1b28e069b9e8b8b5f56a1aa

SHA512
0abf250eb7073fd3be688ae8e3dd26e45ab39d08b2a5400d27dc8bcf3969ac213a99c00cfc1a0dc84bbf0c1142a9122bfb43ddad3e7c595fbf29d5701a788491

Download Submit
C:\Users\Admin\AppData\Local\Temp\50A0.tmp\mpress.exe

Filesize
100KB

MD5
e42b81b9636152c78ba480c1c47d3c7f

SHA1
66a2fca3925428ee91ad9df5b76b90b34d28e0f8

SHA256
7c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2

SHA512
4b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\exe50A1.tmp

Filesize
41KB

MD5
7aa367dca7be65e07b16bd69f06263e3

SHA1
d447739251408f8e8490a9d307927bfbe41737ce

SHA256
738bf50547320b0683af727ad6d430f2e7b83c846fe24f91527b7ee263bfa076

SHA512
d7884589d7d12a628c9e07b77b3b793fa91f67fe13563e7b072ca864e053e6b7d711852e30ae1c877576b8ad47f67d2826e8ee711e6b65a329baa57492fe31b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\exe50A1.tmp

Filesize
24KB

MD5
7cda353434725a4a3712954fd3ded290

SHA1
d8348e79d6bcee527743b126026367d700ddb436

SHA256
7e781837fa89a8ead0a14c14a7f2125a89bb7b33d2ccc358f6b8ad22924b5e86

SHA512
4ac257fe8e0772adc8aa1a2626153c473554c341c025959dd994100c43e2cec274e8a532e0c1b5c0ecdf463733d25a63767b995b731ce272b1c7a3ad0820b95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.dll

Filesize
700KB

MD5
3c9568b0d86a865f9f73d9c0967cfdad

SHA1
3270df3e0e600f4df2c3cbc384837693a8a3a83e

SHA256
c7b97a001b39e17382e929aad924555f3d21886b86aed38cffd660490801d1d6

SHA512
bd423d1d57823b1bf6db42aeec199aa93178a9317ead85b42b60e091aaf4f73ce721bc07fda4750e112c4dccb9d87e21d5793965da9d6e92b0c5bed92c26876f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir.bat

Filesize
1KB

MD5
09df7f6ba7ef626f2998ef38feda717e

SHA1
5398aec27f8552b66673e160bced7e7fb9b55525

SHA256
bae210cbd513a2911f368720317f3c9fe911a8fe80553d6f1b80cc301a453842

SHA512
7d3e3b8117c8a82efa68093974b7217e05740f3422aa62a6d8507ff9d2aabcbe8c0a6fab472eed96537126e6f070f98275fdcc7eeb076102dd8bfedb3e9bbd76

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir.bat

Filesize
1KB

MD5
05b8f0277cb24f2fd5bacd5a300cf764

SHA1
73e4b020b936680060bfc1e97dedd15c74a7fee3

SHA256
a96263e098a2cd159ecbec307b758a8d7b0a93ae3ccde3793af9ccb1cb88d32d

SHA512
cb73b93ee98abbac9a5c28110ffbf916fc6268910148386420f1c6db4f243a790048d61268687ba2739bf906d76de65f17781fb7efdf234f2b50f1e49d315b88

Download Submit
memory/2156-114-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2156-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2388-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2388-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2656-69-0x0000000000540000-0x0000000000574000-memory.dmp

Filesize
208KB

Download
memory/2656-67-0x0000000000540000-0x0000000000574000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads