831f2c4f9ffdcd8a730f72abd1b8a2a716eded13ef33876ed6f704d09027033d

General

Target

emsO.exe
Size

884KB
MD5

c47a7fef0ab6068c68877022965dc13d
SHA1

468d6112130fc9b58092db88611d2ad53cb33a06
SHA256

831f2c4f9ffdcd8a730f72abd1b8a2a716eded13ef33876ed6f704d09027033d
SHA512

f2e7d82f30b359b7d55f99c1fcd5a5680376e3c26b9b10b74f5ee6789480d7f4ab3586d62a85d446db9ba019528b77c4069765ea258c3f2df742f974c07a6d03
SSDEEP

12288:fChkTeH81jJUS5ZsNXTkuF/bbXEQoR1aWX9MbGU6qG/ux5VWYcvyE1tHiwSQYiMo:I8MS5ETzbb6trU6x/ux5VWYcj3

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 2540	1732	emsO.exe	28
PID 2540 set thread context of 1200	2540	emsO.exe	21
PID 2540 set thread context of 2972	2540	emsO.exe	31
PID 2972 set thread context of 1200	2972	unlodctr.exe	21

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1732	emsO.exe
1732	emsO.exe
2540	emsO.exe
2540	emsO.exe
2540	emsO.exe
2540	emsO.exe
2540	emsO.exe
2540	emsO.exe
2540	emsO.exe
2540	emsO.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe
2972	unlodctr.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2540	emsO.exe
1200	Explorer.EXE
1200	Explorer.EXE
2972	unlodctr.exe
2972	unlodctr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	emsO.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2540	1732	emsO.exe	28
PID 1732 wrote to memory of 2540	1732	emsO.exe	28
PID 1732 wrote to memory of 2540	1732	emsO.exe	28
PID 1732 wrote to memory of 2540	1732	emsO.exe	28
PID 1732 wrote to memory of 2540	1732	emsO.exe	28
PID 1732 wrote to memory of 2540	1732	emsO.exe	28
PID 1732 wrote to memory of 2540	1732	emsO.exe	28
PID 1200 wrote to memory of 2972	1200	Explorer.EXE	31
PID 1200 wrote to memory of 2972	1200	Explorer.EXE	31
PID 1200 wrote to memory of 2972	1200	Explorer.EXE	31
PID 1200 wrote to memory of 2972	1200	Explorer.EXE	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\emsO.exe
  "C:\Users\Admin\AppData\Local\Temp\emsO.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\emsO.exe
    "C:\Users\Admin\AppData\Local\Temp\emsO.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2540
- C:\Windows\SysWOW64\unlodctr.exe
  "C:\Windows\SysWOW64\unlodctr.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-16-0x0000000003AB0000-0x0000000003BB0000-memory.dmp

Filesize
1024KB

Download
memory/1732-12-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1732-1-0x0000000000EE0000-0x0000000000FC0000-memory.dmp

Filesize
896KB

Download
memory/1732-2-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1732-3-0x00000000004B0000-0x00000000004D0000-memory.dmp

Filesize
128KB

Download
memory/1732-4-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/1732-5-0x0000000000520000-0x0000000000536000-memory.dmp

Filesize
88KB

Download
memory/1732-6-0x0000000007610000-0x000000000769A000-memory.dmp

Filesize
552KB

Download
memory/1732-0-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

Filesize
4KB

Download
memory/2540-13-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/2540-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2540-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-18-0x00000000002F0000-0x0000000000313000-memory.dmp

Filesize
140KB

Download
memory/2540-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2972-19-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2972-20-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2972-22-0x0000000001F10000-0x0000000002213000-memory.dmp

Filesize
3.0MB

Download
memory/2972-23-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2972-24-0x0000000001D80000-0x0000000001E22000-memory.dmp

Filesize
648KB

Download
memory/2972-25-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2972-26-0x0000000001D80000-0x0000000001E22000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing