ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9

General

Target

ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
Size

6.9MB
MD5

2566562b7c0dffe5985e58e11c5b6142
SHA1

5ce6e1ded25c7c5cd03e8ecdaa92c8c419412097
SHA256

ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9
SHA512

0a2c7abb976a47995b9058c2cb8c8a7a01585839c41055c3933c5a7dc892193a2d2990307168276ffd118a6612a45199b15b79de983b53c941dcee81f3a3fada
SSDEEP

196608:mhUC3fTTEi1xkEq8z0sdhOtqKUt7PQIxvdepn5:mhUs/SsdHfFPs

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0034000000013a53-14.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2620	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe

Loads dropped DLL 3 IoCs

pid	Process
2192	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2192	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
2620	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe
2620	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1700	2192	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	28
PID 2192 wrote to memory of 1700	2192	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	28
PID 2192 wrote to memory of 1700	2192	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	28
PID 2192 wrote to memory of 1700	2192	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	28
PID 1700 wrote to memory of 2620	1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	29
PID 1700 wrote to memory of 2620	1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	29
PID 1700 wrote to memory of 2620	1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	29
PID 1700 wrote to memory of 2620	1700	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	29

C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
"C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
  C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe -a -d
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe
    "C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cyyundun.dll

Filesize
332KB

MD5
8722259b998800a37c3991c58ce64f96

SHA1
d370272422272eaf9aca8bc17ba9bcba1b83df70

SHA256
b115d63bee020042256019ee14fa0570483180e29c4deb7ed5b8fab522b05244

SHA512
867872e22769ecdba19daca70d6ef2bbb9e310abd90ddd1c3ff5b9a3375ef11488f1f7ac021c579ab58b7e8125c8bada584a1e96bb15fcee5837307cb64a6857

Download Submit
\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe

Filesize
3.6MB

MD5
c2141bf81e0cae339ad66d854b5decf7

SHA1
1ec6e4f0ff5fcfbb3bef7091a2a38f592204ebe8

SHA256
035d9b928368b8f181593cdd5abebc4dc6fa543558814142d9991f88e88db0b2

SHA512
3f657d63e86c8356e9102690eb41d6f8323b0111be74672fab84ab6a79e19ce2e92f35bdde41427bf3181af3cf9d69d3aae883f96e1be3fa8f6695150820ea8a

Download Submit
memory/1700-26-0x0000000074E40000-0x0000000074EA7000-memory.dmp

Filesize
412KB

Download
memory/1700-18-0x0000000004750000-0x0000000004B15000-memory.dmp

Filesize
3.8MB

Download
memory/1700-11-0x0000000074E40000-0x0000000074EA7000-memory.dmp

Filesize
412KB

Download
memory/1700-31-0x0000000004750000-0x0000000004B15000-memory.dmp

Filesize
3.8MB

Download
memory/2192-4-0x0000000074F70000-0x0000000074FD7000-memory.dmp

Filesize
412KB

Download
memory/2192-5-0x0000000074F70000-0x0000000074FD7000-memory.dmp

Filesize
412KB

Download
memory/2620-19-0x0000000000400000-0x00000000007C5000-memory.dmp

Filesize
3.8MB

Download
memory/2620-22-0x0000000002430000-0x0000000002786000-memory.dmp

Filesize
3.3MB

Download
memory/2620-21-0x0000000002430000-0x0000000002786000-memory.dmp

Filesize
3.3MB

Download
memory/2620-23-0x0000000002430000-0x0000000002786000-memory.dmp

Filesize
3.3MB

Download
memory/2620-24-0x0000000002430000-0x0000000002786000-memory.dmp

Filesize
3.3MB

Download
memory/2620-28-0x0000000000400000-0x00000000007C5000-memory.dmp

Filesize
3.8MB

Download
memory/2620-29-0x0000000002430000-0x0000000002786000-memory.dmp

Filesize
3.3MB

Download
memory/2620-20-0x0000000000400000-0x00000000007C5000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing