8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce

General

Target

8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
Size

5.9MB
MD5

9d7f2e9361d685cfa1e748fd54e583b4
SHA1

8632f26fb2a79ce56e7fc58ef7347dc805ccec43
SHA256

8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce
SHA512

69cce8b0297cb749d6aeb90e504e876d516cefbfe1e2643c23e68010afdb294ebaecd8ca73ec7cfc0657325cfa1b5ae6b71fe07e41631671aa6817a0c576bc61
SSDEEP

98304:GhUCd5V5Z8mRT4DaEYvX1xkEqNDR/dV6ZeG+5R67kuu6Njj8N9AJsfJD+nbBhDhM:GhUC3fTTEi1xkEqlR/dVue3Rn6NjgjyS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2640	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce_app.exe

Loads dropped DLL 4 IoCs

pid	Process
2800	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2640	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce_app.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2800	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
2640	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce_app.exe
2640	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce_app.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2072	2800	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	28
PID 2800 wrote to memory of 2072	2800	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	28
PID 2800 wrote to memory of 2072	2800	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	28
PID 2800 wrote to memory of 2072	2800	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	28
PID 2072 wrote to memory of 2640	2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	29
PID 2072 wrote to memory of 2640	2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	29
PID 2072 wrote to memory of 2640	2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	29
PID 2072 wrote to memory of 2640	2072	8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe	29

C:\Users\Admin\AppData\Local\Temp\8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
"C:\Users\Admin\AppData\Local\Temp\8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe
  C:\Users\Admin\AppData\Local\Temp\8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce.exe -a -d
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce_app.exe
    "C:\Users\Admin\AppData\Local\Temp\8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce_app.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\8781903a118fa84d6dd1194b42a15bedaf9ac3714a6ba7637f03599a75f5bdce_app.exe

Filesize
2.8MB

MD5
4752dce77495666d331122a4aac240ae

SHA1
62d5ab87a07d388d4fce290631d2c70778a3abac

SHA256
d8574e6d7d12a6511abf942c5212275ab4286288f80e18979b83afbb3360a64b

SHA512
83150e95d23e3d50acc36112452dab7ee90101103f4a7b892b7a738dffdbf295ef2f690447424be449c022f78a3d71565fa04eca55dc8cbe6b27b0255c366c38

Download Submit
\Users\Admin\AppData\Local\Temp\cyyundun.dll

Filesize
332KB

MD5
8722259b998800a37c3991c58ce64f96

SHA1
d370272422272eaf9aca8bc17ba9bcba1b83df70

SHA256
b115d63bee020042256019ee14fa0570483180e29c4deb7ed5b8fab522b05244

SHA512
867872e22769ecdba19daca70d6ef2bbb9e310abd90ddd1c3ff5b9a3375ef11488f1f7ac021c579ab58b7e8125c8bada584a1e96bb15fcee5837307cb64a6857

Download Submit
memory/2072-22-0x00000000045F0000-0x0000000004DE1000-memory.dmp

Filesize
7.9MB

Download
memory/2072-11-0x0000000074750000-0x00000000747B7000-memory.dmp

Filesize
412KB

Download
memory/2072-20-0x00000000045F0000-0x0000000004DE1000-memory.dmp

Filesize
7.9MB

Download
memory/2072-36-0x0000000074750000-0x00000000747B7000-memory.dmp

Filesize
412KB

Download
memory/2072-37-0x00000000045F0000-0x0000000004DE1000-memory.dmp

Filesize
7.9MB

Download
memory/2640-24-0x0000000000400000-0x0000000000BF1000-memory.dmp

Filesize
7.9MB

Download
memory/2640-31-0x00000000767C0000-0x00000000767C1000-memory.dmp

Filesize
4KB

Download
memory/2640-27-0x00000000777E0000-0x00000000777E1000-memory.dmp

Filesize
4KB

Download
memory/2640-25-0x00000000777E0000-0x00000000777E1000-memory.dmp

Filesize
4KB

Download
memory/2640-33-0x0000000000400000-0x0000000000BF1000-memory.dmp

Filesize
7.9MB

Download
memory/2640-35-0x0000000000400000-0x0000000000BF1000-memory.dmp

Filesize
7.9MB

Download
memory/2800-5-0x0000000074880000-0x00000000748E7000-memory.dmp

Filesize
412KB

Download
memory/2800-4-0x0000000074880000-0x00000000748E7000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing