904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607

General

Target

904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607.exe
Size

565KB
MD5

11ff116d302f2384b07727dc70c75a53
SHA1

5c655b9172fad3cd0d6ab81049d79c108ebe8227
SHA256

904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607
SHA512

d67baab2229ae2d94e839d3bf576861f8e44e17ce887c55a33289a491221e2f76beef10bab9bf0f0d0ac4217f29a007e4213c9f21b514907d1730e758df8b9ce
SSDEEP

3072:XtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOLlqw1aQuoYKN6LSSe9oVw:duj8NDF3OR9/Qe2HdklruoYk6LReT

Score

9^/10

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral1/files/0x000a000000015cb6-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0035000000015d42-13.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2876-20-0x0000000000400000-0x0000000000425000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Deletes itself 1 IoCs

pid	Process
2156	LiveMessageCenter.exe

Executes dropped EXE 2 IoCs

pid	Process
2064	casino_extensions.exe
2156	LiveMessageCenter.exe

Loads dropped DLL 4 IoCs

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2156	LiveMessageCenter.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2876	904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2956	2876	904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607.exe	28
PID 2876 wrote to memory of 2956	2876	904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607.exe	28
PID 2876 wrote to memory of 2956	2876	904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607.exe	28
PID 2876 wrote to memory of 2956	2876	904d1bddea1d59c71b9501d7e7eb7c23070e5d89e6bcb6201f98903a56dfb607.exe	28
PID 2956 wrote to memory of 2064	2956	casino_extensions.exe	29
PID 2956 wrote to memory of 2064	2956	casino_extensions.exe	29
PID 2956 wrote to memory of 2064	2956	casino_extensions.exe	29
PID 2956 wrote to memory of 2064	2956	casino_extensions.exe	29
PID 2064 wrote to memory of 2800	2064	casino_extensions.exe	30
PID 2064 wrote to memory of 2800	2064	casino_extensions.exe	30
PID 2064 wrote to memory of 2800	2064	casino_extensions.exe	30
PID 2064 wrote to memory of 2800	2064	casino_extensions.exe	30
PID 2800 wrote to memory of 2156	2800	casino_extensions.exe	31
PID 2800 wrote to memory of 2156	2800	casino_extensions.exe	31
PID 2800 wrote to memory of 2156	2800	casino_extensions.exe	31
PID 2800 wrote to memory of 2156	2800	casino_extensions.exe	31

\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
567KB

MD5
b25386d64fe38582fadf21b8d3d5c8d7

SHA1
cbcfff2ff2b9d54e49c183e0017f95c735d1b9fe

SHA256
f71b4ba6b53c0adeae1a350aa5792fb64028a59c0d2a95115ba84c35400ee438

SHA512
a14a37ec02cf275d06bbbe3a399949c3daa678703389c6ff9f8363f7a5230d6dcc863b522313965089d618e2bdbde736a745aeafc35762e34cd8f7558a9ac737

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
574KB

MD5
c992b9766237cf6494865df0759df238

SHA1
fe5cfed63f1e060fc8077098b2d258af21277802

SHA256
15b09c6df7380f48025fbff5f4d7f86b82cb9b72c4fb2628c67c6c96e0f81942

SHA512
5b354b2a7aebb6f0bd9cc864c5b0f6eee66466ffe875130f72700fe05cc100d28a6461450ab68eb7da4d84fc2f490d9b7188dfee33239dc625d306ae55cf46cf

Download Submit
memory/2876-20-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download