Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 07:47
General
-
Target
11538d4f898de9693d73237939dbdc1ade362be4c78e170fa134b8a006db280a.exe
-
Size
6.9MB
-
MD5
6aa59a37397c2ead9f405b8207cfdc17
-
SHA1
e6237d2163911aca5d2dc0d920da91c997765237
-
SHA256
11538d4f898de9693d73237939dbdc1ade362be4c78e170fa134b8a006db280a
-
SHA512
14ed70cd6b1e60ee9e4180c711fd326e2c6ffc8c82b3420822fa6b0b7db3966ca14d2ecb2f46692e4aef5ace43c232db9f9ab6396c8b015ce3797e8a923ddcee
-
SSDEEP
98304:jCtQAsI29jHcxWjRTp6azZzB8hi4ZoEiAmP+xhctqd60dVADjhSF1O8lw3kBL7l7:ostjRJ/4ZoSQQhtd6sWDlSrM0BLRrzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11538d4f898de9693d73237939dbdc1ade362be4c78e170fa134b8a006db280a.exe"C:\Users\Admin\AppData\Local\Temp\11538d4f898de9693d73237939dbdc1ade362be4c78e170fa134b8a006db280a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A2QKI.tmp\11538d4f898de9693d73237939dbdc1ade362be4c78e170fa134b8a006db280a.tmp"C:\Users\Admin\AppData\Local\Temp\is-A2QKI.tmp\11538d4f898de9693d73237939dbdc1ade362be4c78e170fa134b8a006db280a.tmp" /SL5="$60188,6990075,68096,C:\Users\Admin\AppData\Local\Temp\11538d4f898de9693d73237939dbdc1ade362be4c78e170fa134b8a006db280a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5a131a4480de223bef93b86bb0d800a5a
SHA1ab3b04f4546283434b9170cb3e3f6e254048d4ac
SHA256fff22f6006af8d262ce14d00c6ffa69a5be609f0d5419b518011a6555e2cce77
SHA5124da365ffc70bc8b47a890270f75ba2518311261005fb02eac96256f008320cf7eae47d47346343152baf05e87a59ac07501ac3b18a1ca33cb130f0e3e4f6f915
-
Filesize
53KB
MD5ba09c0348769b1e6b33389fe6b4d947d
SHA1f2895be8810036b466f849b44f254fb25349218f
SHA25655f8ae64de7317c13930021e6a7c4f3d33e3e53b9e08ea69a9d5725034f1ca68
SHA5126928b61b8d27b2d4cea03755a10599705d9610a7c6fe64109cb350cce6fcf129f31da3d825faf75e2783c6a512297ee906b00eaafe295489e4b990de9f0b7c2c
-
Filesize
157KB
MD5e3b26d132de597587782e985f65e78b1
SHA15546b8597bb8f515c56cd117e6f5024388491996
SHA256ea46dea017922358d83fe7e6286c64fc06f797d9bd65596671a15eddfed3d6b6
SHA512f0e0a387420e8597a3c5de6ca887f638b4103083176c620e43d3564d97d4ec8955bfafb73893ea9b4705d4d2a953aae68e1ea3f3405f1200053740a2dcb3ac94
-
Filesize
84KB
MD5862c6717b4b8f82863fe356da7c1b2a4
SHA197e499df258890c90465bbccd8e0aeb8f827e724
SHA256f5e8d6d24e50a1c85c2db637f02a381c0c177442f556ea3d14de6605f0b0d2a7
SHA5120830be0f5e670cc74ec8a9f3e30b2154deede9b51e5dd2e8685d4e067d15793d393c500f88f5beaa9cf762d9e8f7066a7146e1da253630ac01e234cf6737a337
-
Filesize
183KB
MD5ec4d0d6a2fa8913558e660deac342d49
SHA1bd0c6da9790a580e27fcc131dcce33a8cf0ffbd0
SHA25662c01bcf71753e22bd2b37825a5ae18714e6273a9fd3a23788c43574300223e5
SHA5121afe741a3328e09f9070468d79b18d1d06378d7707f70c4acdc9744f5ac064ee295b6805dc18eb91f542ed07a8fa1f1404cd0e238715412602a10c20a73832f5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB