Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
-
submitted
11/12/2023, 07:19
General
-
Target
b9dfbf28eed8b566871d0a5d2e061afa8bd828d7f3c8f8ee3eb5aa73295bb20e.exe
-
Size
6.9MB
-
MD5
73d3ec9b6ee874927ef51d224b56e056
-
SHA1
5d074c4b6b71f555b1c18da5416d95933d817ae9
-
SHA256
b9dfbf28eed8b566871d0a5d2e061afa8bd828d7f3c8f8ee3eb5aa73295bb20e
-
SHA512
01588871ad857cac38ccf59df42efa463a37b21ee18936a927758eaf653217f8becd78772edccc249bc42b46f34a9a12d701deafbf68c9c2a67ac8edee008ca7
-
SSDEEP
196608:IH/2cOhoGEpX+jRFRvz29jgM7+3Utny3r/mvZO0agzj:9cOhoGE1ArRvqlgM7xtAT0Hzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9dfbf28eed8b566871d0a5d2e061afa8bd828d7f3c8f8ee3eb5aa73295bb20e.exe"C:\Users\Admin\AppData\Local\Temp\b9dfbf28eed8b566871d0a5d2e061afa8bd828d7f3c8f8ee3eb5aa73295bb20e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CTGUC.tmp\b9dfbf28eed8b566871d0a5d2e061afa8bd828d7f3c8f8ee3eb5aa73295bb20e.tmp"C:\Users\Admin\AppData\Local\Temp\is-CTGUC.tmp\b9dfbf28eed8b566871d0a5d2e061afa8bd828d7f3c8f8ee3eb5aa73295bb20e.tmp" /SL5="$F0056,6982471,68096,C:\Users\Admin\AppData\Local\Temp\b9dfbf28eed8b566871d0a5d2e061afa8bd828d7f3c8f8ee3eb5aa73295bb20e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
926KB
MD5420c7ce37e27ac3b1f2765c8538441f3
SHA177f2c0e770634448ec71902125ca7d704515ec62
SHA25628957b2bd2c16caed452759dbaf47f7ecd3fe292efb8f85c4ed36c42bb417d75
SHA51222e36767f28d3174fc468320a853f486112850e17e6451d37a93558e8c7a7a477c1d1d246087a39e4e097465c376f6c2aecc041b70145be22d44f2b32897f542
-
Filesize
1005KB
MD573977d02fdd50b53957f635bb380818a
SHA1790e0f57b07f974d5e5375311dd6ef0b7bc398b2
SHA256e8c0d521f753608a6c1750a33b079ef0532f534026f76e737950299805e30d49
SHA512b3ef03c6f086208ca9c418294616374b325839fada1d0fc02f82449fede45e0011d41945dfc463b1f2f4c57aec36ac864199bd4f90412d76650d77a258f0e4b8
-
Filesize
840KB
MD5361407c25a09112b23fa788044806bc6
SHA136c2d368f19f74f5fb25598f5aff9aa501aa535f
SHA256c677c0da915fa696838aea940ace53ea0390dcdd846c2553d9505831c121283a
SHA5120abb6a058cb5a9212d0ab86f83909479937e9b3c5e6ccb7bb95f72c7ca412b173e87f79273c11180fb5e5a8c8322fc9c697750b11dc261567c4c58f14c307ad7
-
Filesize
423KB
MD51b3d1d3b89fdbf36d25e4752a7450e48
SHA15961fd44d7890e4e2fbc55d195e061965454910d
SHA2562d313c5727007b8717a4c71e867f24ab0d9ea683e0e1e7a8f689c2573fc6d421
SHA512ccbb5bbb87b9a484a34ff741e282d402520310041b990d298f8521e801c75be2dabc14181edcc698a191285705763ad6486436845f7b839bcaea20313537d2cd
-
Filesize
628KB
MD56fa8a6328fd83905d094ee46b946be37
SHA1daf9ea91690f97c3dd268693862a6bc74b3eee0b
SHA25678d035076a5b7bf92327597567824b0d520ced2f7806182430f55797315ba0a6
SHA5124b82424f43722925bfd50ea4824c6aa8daf35fb0ac9753b77286a87f6c5d0adfe98019c9948d923f350c1982a6b1c224eb69e740eb4d29506828bf4e39af069d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB