Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 06:15
General
-
Target
36baa1fb0bdb5b9d00df3bc47c8d6717d47e00f02d0439a4263948436847c872.exe
-
Size
6.9MB
-
MD5
1eb3a9d31e5d43e3fb07d676c9c5f0da
-
SHA1
909cb97ee2458a7ae19025a5514bf22912bf7e1a
-
SHA256
36baa1fb0bdb5b9d00df3bc47c8d6717d47e00f02d0439a4263948436847c872
-
SHA512
18aba28ae5395fcad5509616d17aef4352c582de3ef383d798810bd8397b19cb5cb8a70a142cb12242a2958cd02932be04c32239597bac9e63c9dec6bf5b634a
-
SSDEEP
196608:hH/2cOhoGEpX+jRFRvz29jgM7+3Utny3r/mvZO0agzj:YcOhoGE1ArRvqlgM7xtAT0Hzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36baa1fb0bdb5b9d00df3bc47c8d6717d47e00f02d0439a4263948436847c872.exe"C:\Users\Admin\AppData\Local\Temp\36baa1fb0bdb5b9d00df3bc47c8d6717d47e00f02d0439a4263948436847c872.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CLRCS.tmp\36baa1fb0bdb5b9d00df3bc47c8d6717d47e00f02d0439a4263948436847c872.tmp"C:\Users\Admin\AppData\Local\Temp\is-CLRCS.tmp\36baa1fb0bdb5b9d00df3bc47c8d6717d47e00f02d0439a4263948436847c872.tmp" /SL5="$50232,6982471,68096,C:\Users\Admin\AppData\Local\Temp\36baa1fb0bdb5b9d00df3bc47c8d6717d47e00f02d0439a4263948436847c872.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
998KB
MD524c27eb3b0f7fc2bf23cc352728d866b
SHA118a66004d7465146dbf1013a70ef47de59041b61
SHA25632a82ecb16190d558318f80089371e3ef54f6a7deb11f8175ba5984d0900ed40
SHA5126d8936f3c787a3fb132f96a686574024c969553623c7b339a9600428997110e2feb4db80c2c3cf70d22ca730b5a3f5bc3d56cbded98801706b2957652f0570da
-
Filesize
582KB
MD5c747f077f4c5044670b7292e336f36ba
SHA1edf7fa2442cf685f019f288a0d762ff442346564
SHA25644ba5c0047c1aff4b64560872e7ed32bd39104927c7998632464a7008c88093a
SHA51278504cfa2cfac89c6bf278b81f2b30330b2039c1417884edf27606b37ad4f1f5b4b5e09658a3dd7c77d6f6b57bbb0fcfc02ddc53c5f85d6459096b9f0fda448c
-
Filesize
93KB
MD5716e642cea5e877b8b61a3dcfc82d18d
SHA1be4ba08b5f9bf05002a24ba20313accaa67a80a1
SHA256f982b5828a527a269b4581d9aabad25d2797b46f948ed1b6aadeaea87a5bbd06
SHA51201edb1ba09aa1af2af7cad43ca1e874ae3492f997b5a23b41ee6d521e142c3ca9d620addd29fe0a10e3330a939618922de9d6767e14f5f6af1f59459e111a292
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
96KB
-
Filesize
96KB