Analysis
-
max time kernel
168s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
01-11-2023 21:44
General
-
Target
66382a7fdd1d000fc036ec5417f99d403fdcb9990eaf73ead388548fd5c2b82f.exe
-
Size
5.5MB
-
MD5
ea53123162b243e7da01c699545fb1b7
-
SHA1
baa6dd4f524a6acf16c037e4e53c6eabef7c35fe
-
SHA256
66382a7fdd1d000fc036ec5417f99d403fdcb9990eaf73ead388548fd5c2b82f
-
SHA512
9075bdba2e46e548bb4e04939eef04370658ffd013627f7fdb6c730230572a6677ef5bc30ada6bab4677a5785f079f7d8303ec3e7a25902aee5a7408bb0a819c
-
SSDEEP
98304:Xie00nULgOIxoT3H/aIMhXCjiHGpT7eLEpeUNZGeq/ovf01+ZrXBRPyfDW9388pg:yL0uhxT3yIpcFEphGL71erXBRGDG38Wg
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 34 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66382a7fdd1d000fc036ec5417f99d403fdcb9990eaf73ead388548fd5c2b82f.exe"C:\Users\Admin\AppData\Local\Temp\66382a7fdd1d000fc036ec5417f99d403fdcb9990eaf73ead388548fd5c2b82f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SBS23.tmp\is-9BM1E.tmp"C:\Users\Admin\AppData\Local\Temp\is-SBS23.tmp\is-9BM1E.tmp" /SL4 $70202 "C:\Users\Admin\AppData\Local\Temp\66382a7fdd1d000fc036ec5417f99d403fdcb9990eaf73ead388548fd5c2b82f.exe" 5463736 1576962⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 14⤵
-
-
-
C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1111.exe"C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1111.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1111.exe"C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1111.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD5e7ed7873f9923d28dfeb27c2c6d1a6ab
SHA1aefd57d4a826b69de5762ad44995ea3646b07fc8
SHA256b385022f1efc22fa4df196ebae810ec093b529904c3d4aaad6c98cbb69912fe8
SHA51221186aacbf721901642a1ef866a92896586340d610d47b8690431361d37e62fb0752749919103f1b3ef6e6ca0b8c4b47d11c51856333822592e3bef1c9353c8c
-
Filesize
4.7MB
MD5e7ed7873f9923d28dfeb27c2c6d1a6ab
SHA1aefd57d4a826b69de5762ad44995ea3646b07fc8
SHA256b385022f1efc22fa4df196ebae810ec093b529904c3d4aaad6c98cbb69912fe8
SHA51221186aacbf721901642a1ef866a92896586340d610d47b8690431361d37e62fb0752749919103f1b3ef6e6ca0b8c4b47d11c51856333822592e3bef1c9353c8c
-
Filesize
4.7MB
MD5e7ed7873f9923d28dfeb27c2c6d1a6ab
SHA1aefd57d4a826b69de5762ad44995ea3646b07fc8
SHA256b385022f1efc22fa4df196ebae810ec093b529904c3d4aaad6c98cbb69912fe8
SHA51221186aacbf721901642a1ef866a92896586340d610d47b8690431361d37e62fb0752749919103f1b3ef6e6ca0b8c4b47d11c51856333822592e3bef1c9353c8c
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
642KB
MD5e57693101a63b1f934f462bc7a2ef093
SHA12748ea8c66b980f14c9ce36c1c3061e690cf3ce7
SHA25671267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f
SHA5123dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e
-
Filesize
642KB
MD5e57693101a63b1f934f462bc7a2ef093
SHA12748ea8c66b980f14c9ce36c1c3061e690cf3ce7
SHA25671267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f
SHA5123dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
4.7MB
-
Filesize
692KB
-
Filesize
828KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB