Analysis
-
max time kernel
293s -
max time network
295s -
platform
windows10-1703_x64 -
resource
win10-20231025-en -
resource tags
-
submitted
10/12/2023, 22:25
General
-
Target
54fb2790cb71b8e92d1a3eb42066342c71b56ac48915cb398ff6f7e93d634788.exe
-
Size
7.9MB
-
MD5
fffcf764a59f96cf39e1efce2ec3859d
-
SHA1
aa7aaad7f2b5457c12b1d8a37b82cb33b96bb8f8
-
SHA256
54fb2790cb71b8e92d1a3eb42066342c71b56ac48915cb398ff6f7e93d634788
-
SHA512
ba27f0cbeb330cba74dc6bbefe52157096c0587a127bdeaffae7917ce7202fcc40228d4b09fac29522fc07b42c8f863ea81dc73c7f226f626925fc929c570cbf
-
SSDEEP
196608:NYvJGDLc6WpBQz7DfVoF9bFI9qQaki61QxvmON/Xuevjd:yvJGDw6WpWz/fVM9pI9qQbi61cb5
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54fb2790cb71b8e92d1a3eb42066342c71b56ac48915cb398ff6f7e93d634788.exe"C:\Users\Admin\AppData\Local\Temp\54fb2790cb71b8e92d1a3eb42066342c71b56ac48915cb398ff6f7e93d634788.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-U2PNJ.tmp\54fb2790cb71b8e92d1a3eb42066342c71b56ac48915cb398ff6f7e93d634788.tmp"C:\Users\Admin\AppData\Local\Temp\is-U2PNJ.tmp\54fb2790cb71b8e92d1a3eb42066342c71b56ac48915cb398ff6f7e93d634788.tmp" /SL5="$C0056,8048718,54272,C:\Users\Admin\AppData\Local\Temp\54fb2790cb71b8e92d1a3eb42066342c71b56ac48915cb398ff6f7e93d634788.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CoreTablet\coretablet.exe"C:\Program Files (x86)\CoreTablet\coretablet.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CoreTablet\coretablet.exe"C:\Program Files (x86)\CoreTablet\coretablet.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 73⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 71⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
743KB
MD5ceda24af7b69565b6ff732744182727a
SHA14c20da7e85eb6acc82e5a7c23f0c9b82772e8362
SHA256a96b9d2e3624866828292f0ab7c32a742fbe6edb22d1962035e84cefb49bdb40
SHA512aab983f07a01a908b4467ffec83c7759fd0b107ec596b209b306604b654deffbf35998c387ff934face2baa763a06470497a853346de4b9cafd1997a4940030a
-
Filesize
646KB
MD5014ce8521155c27fe98007dffed6a1e4
SHA187d9d8006ac8ed6f53554be805c0909d8150baff
SHA2567f803528c69c1e0b75595d592beb715b725f522e9e150e5aba3b0b7da11ef97e
SHA51264dcf22fb362e3800b419056d9f6fdb2084bd73b62c66af2612b209a5bfd603b455618bb2a8d5f2a60879b3f59a2a45f43542730d7daa3ee4f0c3bb4abcbed07
-
Filesize
917KB
MD51ae140726d357a2984f8d06a93a6496d
SHA1e22331664d6e6b6c4d8ab5bf84ab3cb4e27cf11f
SHA256943b13d82c281c4d3614351e6afc8bb27c6b25f18e92665e230fbd124a8b6b07
SHA512be1ebabe5ddc6e9a3882574b933395a21843e73accb44a8ab2e924a18bca16afe929b13aaabf0a9d2611e22309d4446a616f029e00c2b6f4309f540152d48c23
-
Filesize
265KB
MD5e9bbe97e3b873bd9fd6ea110baea49fd
SHA132cf55deca82b6b9e9049eb5b40d3ea1e6e64458
SHA256e68e53800076ccd3d11952af0645d4f929bff8e59b0058032c1b6212a1665863
SHA51236b0f9f035ac6a2064fef015c13b1fb308ef39261ff41c201cfa830df8d398643d5da21e3db79efdddc0687f54b316f5bacd2bf81530f705bd299fc9cc5e348b
-
Filesize
336KB
MD5cec2798fd8ff775d4e85dba23424b5a0
SHA1de691516fe3548a660a11fe565d3ae8e6fdde8a7
SHA256656197d0660f58f29886f855f00f8d950a6e265e83ae8020e020b2f9150a7891
SHA5120d87faf3fb8e66ef27f62e00f9a657c7867eb415e11dfe4f130a99e08429a7f5b5cb25cd4038d54f555536da20e83dbd789003043b3e50c902801b860dbf29c1
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
648KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
648KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB