Analysis

  • max time kernel
    183s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 02:48

General

  • Target

    74a0e6da85b94805b9d18cba20714843350ad807d5d7c9398eb4d90c9114d7f4.exe

  • Size

    18KB

  • MD5

    cf10800f44769adb7fa525144b9bc112

  • SHA1

    162e236956778f48dad90b57798e9c3d84059aee

  • SHA256

    74a0e6da85b94805b9d18cba20714843350ad807d5d7c9398eb4d90c9114d7f4

  • SHA512

    67b51c9e589016189a95fbc67a7bb7aa77465f514885e3d96424418358582752139e40183962d580ac52ff7629c1d3ff6fb7c7f69d04e95f8d1f1b1f6c338210

  • SSDEEP

    384:+qh9iywwHkhoTT45gMkmKk7GY1ISpZWwnU4OF1O:d3iy5NM1kmp7GY1RKwnU4ObO

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74a0e6da85b94805b9d18cba20714843350ad807d5d7c9398eb4d90c9114d7f4.exe
    "C:\Users\Admin\AppData\Local\Temp\74a0e6da85b94805b9d18cba20714843350ad807d5d7c9398eb4d90c9114d7f4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\ProgramData\wualct.exe
      C:\ProgramData\wualct.exe
      2⤵
      • Executes dropped EXE
      PID:3768

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\wualct.exe

    Filesize

    18KB

    MD5

    cf10800f44769adb7fa525144b9bc112

    SHA1

    162e236956778f48dad90b57798e9c3d84059aee

    SHA256

    74a0e6da85b94805b9d18cba20714843350ad807d5d7c9398eb4d90c9114d7f4

    SHA512

    67b51c9e589016189a95fbc67a7bb7aa77465f514885e3d96424418358582752139e40183962d580ac52ff7629c1d3ff6fb7c7f69d04e95f8d1f1b1f6c338210

  • C:\ProgramData\wualct.exe

    Filesize

    18KB

    MD5

    cf10800f44769adb7fa525144b9bc112

    SHA1

    162e236956778f48dad90b57798e9c3d84059aee

    SHA256

    74a0e6da85b94805b9d18cba20714843350ad807d5d7c9398eb4d90c9114d7f4

    SHA512

    67b51c9e589016189a95fbc67a7bb7aa77465f514885e3d96424418358582752139e40183962d580ac52ff7629c1d3ff6fb7c7f69d04e95f8d1f1b1f6c338210

  • C:\Users\Admin\AppData\Local\Temp\TMP110509.tmp

    Filesize

    102B

    MD5

    2cb8a89c98001f5eac9df73a60b8585e

    SHA1

    5e043b6361f728a1fba6f9d86b83064a6304ccdf

    SHA256

    a0ff1440bc77f3c14caf22d2e54e6f350c0c529f7c9cde566c986b94e7eafabe

    SHA512

    eb62e499752dfcd3b6d3ed1f5fbabb912c70b75e116445d0b5683793fdf4dd1a585bf888e9dccb9b0b8434f518ad0333325cf6e568275fd607423df526e406a7