Analysis
-
max time kernel
146s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11-12-2023 07:10
General
-
Target
a8df5b0ef1446be203f5aafce20e77d5340d491806859a55caff51da2d7bf784.exe
-
Size
6.9MB
-
MD5
da0e0bb81faaf7e6168c51e7cf8c3cc7
-
SHA1
c85ffa5359f88a2e0c3242a2cc384dd4c8aaae7c
-
SHA256
a8df5b0ef1446be203f5aafce20e77d5340d491806859a55caff51da2d7bf784
-
SHA512
161d43cca47a8304c6a4ce7294ad8ee48e64649e86a7f0c7736de475e7fe4138c3744cf28903bf8b39a807a0de9e0c688b574bce74995807ee8fb8fd1890480a
-
SSDEEP
196608:ZH/2cOhoGEpX+jRFRvz29jgM7+3Utny3r/mvZO0agzj:QcOhoGE1ArRvqlgM7xtAT0Hzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8df5b0ef1446be203f5aafce20e77d5340d491806859a55caff51da2d7bf784.exe"C:\Users\Admin\AppData\Local\Temp\a8df5b0ef1446be203f5aafce20e77d5340d491806859a55caff51da2d7bf784.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-N3V3J.tmp\a8df5b0ef1446be203f5aafce20e77d5340d491806859a55caff51da2d7bf784.tmp"C:\Users\Admin\AppData\Local\Temp\is-N3V3J.tmp\a8df5b0ef1446be203f5aafce20e77d5340d491806859a55caff51da2d7bf784.tmp" /SL5="$401EE,6982471,68096,C:\Users\Admin\AppData\Local\Temp\a8df5b0ef1446be203f5aafce20e77d5340d491806859a55caff51da2d7bf784.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181KB
MD5611195f32b83a24279420e5f93e5bbc6
SHA1882a97a63e11d675b14f373280597fb409397b21
SHA2561af859de16f232229f28140f24e83b7443821180e40ddd76d88459b81d3a7593
SHA51276fd3929fa5fc28f41c35fe14f2ad06281bb9e4466b3c4d4ef514fdc9b1e9a7c65532f3f5217a447340607d5432b9b1a1caac628d70435948f4e6d9571f49401
-
Filesize
326KB
MD5da844006572f4729ed876827488271c4
SHA18ee16b0077b2c5f71051da2f0350a4aa6ccc7b8b
SHA25633adeccf08edb852f88c4e4c59b9d05d19a1d757d36f9cf5d0309135e9e7047b
SHA5123973d694ed777d16f41273c09b583dec8f21c7b98a4f9891850376e100c4095584bdc12bdb10ea8b1b780e2e123166a1c42d03b7203cc3b93d5ef3f368afb353
-
Filesize
177KB
MD5b0fd2fc150edbc9159ef201230f22de9
SHA1519465ad86846092da74ca3e2fdd3868ce5c68d2
SHA25631e788a54b76001bdb8f37573a0844c70f9813d3b04c972029c5389fa98d57fc
SHA512bb65481ec7df89e5f12d21f85e60a5b0d6486dc08ae435324698cbdf636f6a2ea1a5ac4b809990bca959dab5aad04aa73653f07ee90a16f410e1cf7d1e822c62
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
363KB
MD5dc30626c9d230afc3e22a2229eed90d8
SHA1c76eed3c9139ebffba62d6a76204f6faaabbd5da
SHA256f1d7d92fa202b137c06f74dfef9a4ea0591feb3344a0230892260d3510483365
SHA512f0277913032ba14bba3ad0b134c32de68760c6a70f295a1a87b580fcf7dd1a7908ff190d581df5177df24387acaa8bc0f5a3160a24f74ebb35afec593921bc9e
-
Filesize
503KB
MD5f079e1604a29dcd033709ebc8057449f
SHA12585d0ffe41eb1a81dd180ab8bd451957ec02661
SHA256497411d5db46600f49038156de5957581b9b79af0dd8a8e9911809867a73a5c5
SHA512db17b7158d3e1ab59e5b28d023b1766a0c241e1497f53a6c0a2848634c0aaeafc6af455a2a0e39eee123b7142e8f91a5b1808910c8b9eef7fa3a56d90e9df8a7
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB