Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 23:27
General
-
Target
3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe
-
Size
7.6MB
-
MD5
21f8f09df645fe6d8266e32b42983080
-
SHA1
6f73a2d809738c71706dbfd92456ad563e05f43e
-
SHA256
3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1
-
SHA512
35aec72a84d5d532aae3b69a8e2fc5da7f005d9545df05410556228355099cf8d98d35851ff1c21145cc85653cf20df6500ac26b68485e2c5b4ef49299e3b0ac
-
SSDEEP
196608:fnnY8NWvGpWTTlm0OxwW+nFnfZsMUdFt30Dzj:fnnY8NELTIrxwlxQWDzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp"C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp" /SL5="$60188,7715663,68096,C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
970KB
MD5b3af7e960026b31827e298c4e5514480
SHA16c9403d5de419780707c798e16f93ce698009bde
SHA256a27b94673bff5a891ae159aa7d21de18f98fd42eecf8482a7879c43d094c965e
SHA512def1ec4d3745bcfca308acc15c21b764cf877bcb7607b499fcce7a0e45523f1d404465522ef527311ff895c4869ac409c1627e9b9575805a2c57383423fe9f8a
-
Filesize
851KB
MD54ea6b12e7ff65045f8dfa55f1ec4bf71
SHA149e9f07bb33d921c1f78d7a640118ecbf0c63980
SHA256a2ddb4617ffbeec2140e943b9f7dbb3f4645971b86c59b5c1ec01b71a4f98b8d
SHA512afe72a42b2bd160f7f1a1603d0a1843e46ade40df7af6ed2d33b077ff50238b9bdea9f1e0e7791126337a9b87499eac720fc81dcb2b7feb81fab3edb14a8078c
-
Filesize
816KB
MD531bda5c86e5781b9e0a8f36014481fc9
SHA1c38c7b05551d698504f3f0eb971af04e897b5079
SHA256394de657e5d80462bcc6e75f4438ac185b2b6e1f575f7a7f4ac9d3c4f5458892
SHA51217c7446c9f11f597078aaae1dd8100e2b41e58b118a64cbbc86325aed53ff2eb096c16beaffeabf311378d50e756f599ced3348ee36628c1eaa1bb9801b496c5
-
Filesize
444KB
MD51502ea7e29989eb930df6e9c135fe1a4
SHA1c443aec51251ee642d8cc6aa9f8291b71c645186
SHA2560805d4989664a4aaaa3cd446a04a09a103619c39349e1a8f06e9cab22c613f7d
SHA51250b85936d04dc971d4bf1a898faea4d73f88d566631063c72137dd065a2ac7231bdf4756403b3864e0b0afe9e3f922862e72db0b9ddad908bb0a48ca62952bfb
-
Filesize
412KB
MD55bb6216ca71740697ca565c5aa72f7a1
SHA1d55ba5e15c175cc7394ed6eb708f907792f5f21a
SHA2562c0490b7aac90f39c8a3c3e56b77baac43f33b3117b94d563374f354d415786d
SHA512deb46475d4896735bb8106e29cefeb8054528234b5b3d958ee44e0904829ebf31e0b0ab9ea929c7a6e481107b89f60dde28c9dd3572cd8614425dfc544b6694a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
632KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
632KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB