ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9

General

Target

ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
Size

6.9MB
MD5

2566562b7c0dffe5985e58e11c5b6142
SHA1

5ce6e1ded25c7c5cd03e8ecdaa92c8c419412097
SHA256

ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9
SHA512

0a2c7abb976a47995b9058c2cb8c8a7a01585839c41055c3933c5a7dc892193a2d2990307168276ffd118a6612a45199b15b79de983b53c941dcee81f3a3fada
SSDEEP

196608:mhUC3fTTEi1xkEq8z0sdhOtqKUt7PQIxvdepn5:mhUs/SsdHfFPs

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00070000000235be-17.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4200	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe

Loads dropped DLL 2 IoCs

pid	Process
1432	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1432	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
4200	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe
4200	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 628	1432	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	91
PID 1432 wrote to memory of 628	1432	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	91
PID 1432 wrote to memory of 628	1432	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	91
PID 628 wrote to memory of 4200	628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	95
PID 628 wrote to memory of 4200	628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	95
PID 628 wrote to memory of 4200	628	ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe	95

C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
"C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe
  C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9.exe -a -d
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe
    "C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4104,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cyyundun.dll

Filesize
332KB

MD5
8722259b998800a37c3991c58ce64f96

SHA1
d370272422272eaf9aca8bc17ba9bcba1b83df70

SHA256
b115d63bee020042256019ee14fa0570483180e29c4deb7ed5b8fab522b05244

SHA512
867872e22769ecdba19daca70d6ef2bbb9e310abd90ddd1c3ff5b9a3375ef11488f1f7ac021c579ab58b7e8125c8bada584a1e96bb15fcee5837307cb64a6857

Download Submit
C:\Users\Admin\AppData\Local\Temp\ff5a02535a58aef5a7390f4497963f2585da9df59613e97e6c4e950d0ebc8ef9_app.exe

Filesize
3.6MB

MD5
c2141bf81e0cae339ad66d854b5decf7

SHA1
1ec6e4f0ff5fcfbb3bef7091a2a38f592204ebe8

SHA256
035d9b928368b8f181593cdd5abebc4dc6fa543558814142d9991f88e88db0b2

SHA512
3f657d63e86c8356e9102690eb41d6f8323b0111be74672fab84ab6a79e19ce2e92f35bdde41427bf3181af3cf9d69d3aae883f96e1be3fa8f6695150820ea8a

Download Submit
memory/628-13-0x0000000073BC0000-0x0000000073C27000-memory.dmp

Filesize
412KB

Download
memory/628-26-0x0000000073BC0000-0x0000000073C27000-memory.dmp

Filesize
412KB

Download
memory/1432-5-0x0000000074190000-0x00000000741F7000-memory.dmp

Filesize
412KB

Download
memory/1432-6-0x0000000074190000-0x00000000741F7000-memory.dmp

Filesize
412KB

Download
memory/4200-19-0x0000000000400000-0x00000000007C5000-memory.dmp

Filesize
3.8MB

Download
memory/4200-20-0x0000000002B30000-0x0000000002E86000-memory.dmp

Filesize
3.3MB

Download
memory/4200-21-0x0000000002B30000-0x0000000002E86000-memory.dmp

Filesize
3.3MB

Download
memory/4200-23-0x0000000002B30000-0x0000000002E86000-memory.dmp

Filesize
3.3MB

Download
memory/4200-22-0x0000000002B30000-0x0000000002E86000-memory.dmp

Filesize
3.3MB

Download
memory/4200-24-0x0000000000400000-0x00000000007C5000-memory.dmp

Filesize
3.8MB

Download
memory/4200-25-0x0000000002B30000-0x0000000002E86000-memory.dmp

Filesize
3.3MB

Download
memory/4200-18-0x0000000000400000-0x00000000007C5000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing