3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3

General

Target

UNLOCKER V2.exe
Size

5.6MB
MD5

872b0fa8c0306040f181d08c5d7a252b
SHA1

a08cf74361c96aa4d7e4503af6563c63b95f1973
SHA256

3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3
SHA512

23d8610ac8bfcb68695b652dd8d35edcc5f17994c90966ef0cabf11489d983cc852dd8e6d36ec85c78ec6f63cb6a7b21238a6d9687494f3ef99bc7ca86a4a277
SSDEEP

98304:GRx4heu/+/tswG+PJPigEtVTH41ZE6HqM/aZeOO4wZivrH/LXmfI1ZWQpy:GL4gy+/tbG+PJa3txT6KKaLbwZivrjdJ

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

UNLOCKER V2.exe

pid process

1976 UNLOCKER V2.exe
1976 UNLOCKER V2.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2648 timeout.exe

pid	process
2648	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

UNLOCKER V2.exe

pid	process
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe
1976	UNLOCKER V2.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

UNLOCKER V2.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1976 wrote to memory of 2056	1976	UNLOCKER V2.exe	cmd.exe
PID 1976 wrote to memory of 2056	1976	UNLOCKER V2.exe	cmd.exe
PID 1976 wrote to memory of 2056	1976	UNLOCKER V2.exe	cmd.exe
PID 2056 wrote to memory of 2380	2056	cmd.exe	certutil.exe
PID 2056 wrote to memory of 2380	2056	cmd.exe	certutil.exe
PID 2056 wrote to memory of 2380	2056	cmd.exe	certutil.exe
PID 2056 wrote to memory of 2180	2056	cmd.exe	find.exe
PID 2056 wrote to memory of 2180	2056	cmd.exe	find.exe
PID 2056 wrote to memory of 2180	2056	cmd.exe	find.exe
PID 2056 wrote to memory of 2700	2056	cmd.exe	find.exe
PID 2056 wrote to memory of 2700	2056	cmd.exe	find.exe
PID 2056 wrote to memory of 2700	2056	cmd.exe	find.exe
PID 1976 wrote to memory of 2156	1976	UNLOCKER V2.exe	cmd.exe
PID 1976 wrote to memory of 2156	1976	UNLOCKER V2.exe	cmd.exe
PID 1976 wrote to memory of 2156	1976	UNLOCKER V2.exe	cmd.exe
PID 1976 wrote to memory of 2208	1976	UNLOCKER V2.exe	cmd.exe
PID 1976 wrote to memory of 2208	1976	UNLOCKER V2.exe	cmd.exe
PID 1976 wrote to memory of 2208	1976	UNLOCKER V2.exe	cmd.exe
PID 2208 wrote to memory of 3000	2208	cmd.exe	cmd.exe
PID 2208 wrote to memory of 3000	2208	cmd.exe	cmd.exe
PID 2208 wrote to memory of 3000	2208	cmd.exe	cmd.exe
PID 1976 wrote to memory of 2732	1976	UNLOCKER V2.exe	WerFault.exe
PID 1976 wrote to memory of 2732	1976	UNLOCKER V2.exe	WerFault.exe
PID 1976 wrote to memory of 2732	1976	UNLOCKER V2.exe	WerFault.exe
PID 3000 wrote to memory of 2648	3000	cmd.exe	timeout.exe
PID 3000 wrote to memory of 2648	3000	cmd.exe	timeout.exe
PID 3000 wrote to memory of 2648	3000	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\UNLOCKER V2.exe
"C:\Users\Admin\AppData\Local\Temp\UNLOCKER V2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\UNLOCKER V2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\UNLOCKER V2.exe" MD5
3⤵
PID:2380

C:\Windows\system32\find.exe
find /i /v "md5"
3⤵
PID:2180

C:\Windows\system32\find.exe
find /i /v "certutil"
3⤵
PID:2700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CLS
2⤵
PID:2156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
2⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\system32\cmd.exe
cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
3⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\system32\timeout.exe
timeout /t 5
4⤵
- Delays execution with timeout.exe
PID:2648

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1976 -s 2788
2⤵
PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-0-0x0000000077C50000-0x0000000077C52000-memory.dmp

Filesize
8KB

Download
memory/1976-7-0x000000013F6E8000-0x000000013FA85000-memory.dmp

Filesize
3.6MB

Download
memory/1976-5-0x000000013F650000-0x000000014001D000-memory.dmp

Filesize
9.8MB

Download
memory/1976-4-0x0000000077C50000-0x0000000077C52000-memory.dmp

Filesize
8KB

Download
memory/1976-2-0x0000000077C50000-0x0000000077C52000-memory.dmp

Filesize
8KB

Download
memory/1976-10-0x000000013F6E8000-0x000000013FA85000-memory.dmp

Filesize
3.6MB

Download
memory/1976-11-0x000000013F650000-0x000000014001D000-memory.dmp

Filesize
9.8MB

Download
memory/1976-12-0x000000013F650000-0x000000014001D000-memory.dmp

Filesize
9.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads