Analysis
-
max time kernel
63s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
30/10/2023, 08:37
General
-
Target
toponoesis.exe
-
Size
27.0MB
-
MD5
b840e7e147e1c0ce75397d893c23c7bf
-
SHA1
29d60d23d8f527cc6819624feef9502f79c78e50
-
SHA256
c9fa12f510e3c6db27b932b9bef09ea59d7db0c276a937b23d33ceb3f0973dbf
-
SHA512
6f44bd044773fb10649a129f94c73f196f86e788d27204903fbc4afb9dff15208554d973dd2db313f6efb8eb5d9dcfeae2fbbeb778049ddd5614e9f225032e8f
-
SSDEEP
393216:VGkUehdTfTZq5lJqWDMOadpOCewQ9hApI6WCocWj9Bzqct+xOJ9zfJ/Sg/jLcfTd:VjUehBTulJqkOQXApIxCq952Ozzggf0h
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\toponoesis.exe"C:\Users\Admin\AppData\Local\Temp\toponoesis.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UJE4M.tmp\toponoesis.tmp"C:\Users\Admin\AppData\Local\Temp\is-UJE4M.tmp\toponoesis.tmp" /SL5="$40226,27454993,832512,C:\Users\Admin\AppData\Local\Temp\toponoesis.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\TopoNoesis\Zwcad\Zwcad\TopoNoesisZwcad2023.exe"C:\Program Files (x86)\TopoNoesis\Zwcad\Zwcad\TopoNoesisZwcad2023.exe" I3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5edfb1b9ee89ef9a96b37670f686599b4
SHA1e98872255c4f6d568be92d19f62db348d0bbbaf5
SHA2563db620638da4f6aa8c4e4faa125369d12aef0deeba084efaf9a848d2b3a2e1c8
SHA512af6476ac6e62e02c7aac19d53de5a54c91bf6db1a583a0d78a442f7b7e7aec7d0a67b7b6b6df532fc37b576842385988e16b6e846c3c1f2fdc9969e7fe07fb3f
-
Filesize
105KB
MD5c550dc29f8a127e104d5368d1c09ea13
SHA10ee4a028f2bf2eeb15c26503530a516e3624f565
SHA2569e013b91f6d4f99d90b31f34220b37eb17900bfa2237c0bf06dc55e5a97292b1
SHA5122a7239683eb3a3d3b96735debdbd4ed542817599e67e307d5c4439f602a7147ff117346aebd08d1ebde5f141aac47416f2bb7dc00525c368a7ef3dd70846f3a3
-
Filesize
88KB
MD55fbdbaa0834c12b54e1db670853fe707
SHA1e466730689e43f63b120af10ccea74bf6227ec8b
SHA2563a8d8ed2243393b741102b0fe05f1d4d6f970cd241b3bc182cc2958889805b91
SHA5129d8e0f55148358b59c7d66dabc209e56bcc11f532f46a68d12e1c1ef43076a04af9f009292526417391b49abc01aba2b94550a63dd2a6fae15dcdd150f519670
-
Filesize
33KB
MD516d4501f29db9ae6ddc49df80365cd20
SHA130b6eeabcee953bf0e005d0f3f1d5e1a8cf27c4f
SHA25678c93fb8d4576c54d045920183f20b58ebf6f5bc8e81628dca260f55cc7c7ed0
SHA51252c793a82f9356893d6556e35b73502fd1a365477b21be71f1ee4e564c4447370c249fe39469184c49d3f5e8b04ea5e12e8722d1265f2a65e37e718075e8714a
-
Filesize
382KB
MD58611795b70cd1f321cb5cb5aad95ff7b
SHA13adf7d5b701c2ee4af9faa79c36fc724a73a1427
SHA256cfc2edd8ee6a9e91719e493a8ee26938b59d8a2485d8bd4841fa34e9d6fef573
SHA5121658d0dec157dcbb008bda2bc3db227d605c4ad56b853f81a8d8571bb49e8d56780c994447cbd6fa88a2bbae9985ddcb43f8bce032010674eeb78a1f1e7d9486
-
Filesize
33KB
MD516d4501f29db9ae6ddc49df80365cd20
SHA130b6eeabcee953bf0e005d0f3f1d5e1a8cf27c4f
SHA25678c93fb8d4576c54d045920183f20b58ebf6f5bc8e81628dca260f55cc7c7ed0
SHA51252c793a82f9356893d6556e35b73502fd1a365477b21be71f1ee4e564c4447370c249fe39469184c49d3f5e8b04ea5e12e8722d1265f2a65e37e718075e8714a
-
Filesize
33KB
MD516d4501f29db9ae6ddc49df80365cd20
SHA130b6eeabcee953bf0e005d0f3f1d5e1a8cf27c4f
SHA25678c93fb8d4576c54d045920183f20b58ebf6f5bc8e81628dca260f55cc7c7ed0
SHA51252c793a82f9356893d6556e35b73502fd1a365477b21be71f1ee4e564c4447370c249fe39469184c49d3f5e8b04ea5e12e8722d1265f2a65e37e718075e8714a
-
Filesize
300B
MD580166a2c803de67e03ed8b1b07d143bc
SHA190c53d8ebc82056641aeed9340485639176785c1
SHA256db5cceb429ab10ef963e7f35246c18a08ab14635d84d60ccc562095bbd1792d4
SHA5129f63c120a23e699377f29d6d85253f7c733a8dde2820b6dfeafbf87a2a417e48da886577d51ece8f29f0ab1003bdad245bee0d470485f6d82b511b68fcf26d94
-
Filesize
3.0MB
MD5389875fc9f5ada5df2241ecbaa7303de
SHA12a781cc327dc2632e3f6e94ff68eaa3c89875bd6
SHA256e4b9ff6083398c232179d68be40494c3ee643183a352b86f9d2333da82791245
SHA512565fc620326ca69278fe41ea4455bea7c31b6c1294eb765ce4a024505aecb12b72a995f16f7e95d0238769392540caede8bdaaac2c224fb90aead98ac9e4d714
-
Filesize
3.0MB
MD5389875fc9f5ada5df2241ecbaa7303de
SHA12a781cc327dc2632e3f6e94ff68eaa3c89875bd6
SHA256e4b9ff6083398c232179d68be40494c3ee643183a352b86f9d2333da82791245
SHA512565fc620326ca69278fe41ea4455bea7c31b6c1294eb765ce4a024505aecb12b72a995f16f7e95d0238769392540caede8bdaaac2c224fb90aead98ac9e4d714
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
408KB
-
Filesize
128KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB