Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11-12-2023 05:28
General
-
Target
c61b17fd349bd50db951517f866bffecb6ea034ca286ccdfd18ddda2b0362590.exe
-
Size
6.9MB
-
MD5
b039d03e017aa80fcf6491af49d12193
-
SHA1
580fcc0508afe6898ab0c9ef62d2a426e611932d
-
SHA256
c61b17fd349bd50db951517f866bffecb6ea034ca286ccdfd18ddda2b0362590
-
SHA512
537236013ae9853962665a1d16e49213f56d12a32b297d64a421786efb44411f43a054530f4e72cd7f340689f13078e82401965903f0226d8e164f694fbc9269
-
SSDEEP
98304:pzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:kQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c61b17fd349bd50db951517f866bffecb6ea034ca286ccdfd18ddda2b0362590.exe"C:\Users\Admin\AppData\Local\Temp\c61b17fd349bd50db951517f866bffecb6ea034ca286ccdfd18ddda2b0362590.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0DCQU.tmp\c61b17fd349bd50db951517f866bffecb6ea034ca286ccdfd18ddda2b0362590.tmp"C:\Users\Admin\AppData\Local\Temp\is-0DCQU.tmp\c61b17fd349bd50db951517f866bffecb6ea034ca286ccdfd18ddda2b0362590.tmp" /SL5="$5021A,6985458,68096,C:\Users\Admin\AppData\Local\Temp\c61b17fd349bd50db951517f866bffecb6ea034ca286ccdfd18ddda2b0362590.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD5e30d7c7d19a1fd36b7f9a62c5d6e0e20
SHA1fecdd8fd578448fba998f057f03cf100ecdc9dc1
SHA256dc0b89440fa9db03f5d7adb048ae1149629e1a39df09993bdcde90e63a80d99f
SHA51298b47cd951002c1a753cd0c38c35a6468a517e1ad7943b37af7585afe4e3dc54098be143346a73c7097fbea93b558f10df21f6a88e7c72712eaab526fef95dd0
-
Filesize
349KB
MD57925abbfdbf6913d96e559aab9e62514
SHA145683d0bcd23d304e8be3c04507d1ef232714ee2
SHA256100a13aaa4ba53e0346c95ab71b65be1e4bd2e17a514d3cf49a4ba574b855ce4
SHA512cac9ce4d01b0a0ef8ae58ad6a40226672befc6415f47525f62928cc0bc1eef986bf4fbaf15841d313f44b9d8eb87a157761d59880b1e0bbfd02a405a5965d0e7
-
Filesize
326KB
MD5ec0058072f8e9f936081bdc87cd79ec3
SHA1287817806d370d9f9e5996cc203d9d7714b9642e
SHA256b8c73b6fc9204b03c91691977eb8437c31be22e9ea60b6f2d37c7a42c2f3c7f2
SHA512daaa41a1be1e497ccae59171412fa9a87d417211d83ed7f5d32f10c7e61906d2812e1f41a093c426b7b956ee5ad0eaecafbbd13b4065e213af933b58b232b86b
-
Filesize
608KB
MD50ebed89a053ef9fc633abf0c47b663df
SHA182eedeac8b14f9ee6a9b748479b0386b2b51387a
SHA256c1244f008b56e2e38924525fd7d933317ed343dea1f1a760144c6df1956fb986
SHA5127ed18c6e3e11faaf006c9f42b828cbf05cd5ae77f78262b8cb9b062085f6a5db315828b7edac0a1de289e6f5102caa07ce4c39f92f7fd028311d1b81c5a97613
-
Filesize
386KB
MD5ac0552d033712299aca9893a362bc93f
SHA1cd2b2471acbcf0a9cba95ecfbc9b0ddc9d6d3cfd
SHA25627c6fe67ba79db426cd215135e2b2a25d5c775c76ee89a3df61085493413b581
SHA5126007d9f85867ba9be6088b88f30a5cadc0c8eae7c7e4251d2748b5cc7c1f2b89079d82024434fe4e49d4b211d58f2ec0007636df9f092f239a0affa1ce76d692
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB