Analysis
-
max time kernel
143s -
max time network
134s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
11-12-2023 09:09
General
-
Target
41f35004c9168da56c8f7c18e7df7f56f85d2902660b48c6324ecb3221e8e82b.exe
-
Size
6.9MB
-
MD5
867d532540f8ffd9d9fae931ccc43486
-
SHA1
904523c278c107297e59e0ba652af2fcfd225a05
-
SHA256
41f35004c9168da56c8f7c18e7df7f56f85d2902660b48c6324ecb3221e8e82b
-
SHA512
41cc3cac7aefe310f5b534cf3e42e01ba0bf4199c176e4de9784eceba4bc0ab13c05c1d7ae633b938c2cd3476c1d5ad58c01703fd39a77b9965620cd62894827
-
SSDEEP
98304:mCtQAsI29jHcxWjRTp6azZzB8hi4ZoEiAmP+xhctqd60dVADjhSF1O8lw3kBL7l7:7stjRJ/4ZoSQQhtd6sWDlSrM0BLRrzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41f35004c9168da56c8f7c18e7df7f56f85d2902660b48c6324ecb3221e8e82b.exe"C:\Users\Admin\AppData\Local\Temp\41f35004c9168da56c8f7c18e7df7f56f85d2902660b48c6324ecb3221e8e82b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H127F.tmp\41f35004c9168da56c8f7c18e7df7f56f85d2902660b48c6324ecb3221e8e82b.tmp"C:\Users\Admin\AppData\Local\Temp\is-H127F.tmp\41f35004c9168da56c8f7c18e7df7f56f85d2902660b48c6324ecb3221e8e82b.tmp" /SL5="$B01D8,6990075,68096,C:\Users\Admin\AppData\Local\Temp\41f35004c9168da56c8f7c18e7df7f56f85d2902660b48c6324ecb3221e8e82b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5524bfe0d470e2ab13742f92cdbfed508
SHA148101afa30091d7c96a380b5691ffacb5bc384df
SHA256c4c9b495dc588973e4e7309756105795a1d3e0328fa19337a97f5b8a3ed45ea1
SHA51250beaf5e63bdcfa1cff6fc3c4d88ba77e3ec55f6ae9d81163dea30b83f91fb672964460167a66730735d2fccfc8f92a209d272f69349b31b162abe939c7c504e
-
Filesize
1.7MB
MD5baee9a948c31beb2cbfd14186b9ec2d0
SHA1676fb2ecffe5e070c5b4ce5ffc4ccbf884d804fc
SHA256a319b8ffbc643a1cd13c215ce0a6cd048ba0d2a12c1672595f419f846b5c4deb
SHA512ba535b3c0001f0c3af2220521cfec0b5bc410c418d49e9a2f5f556a8d27122d82404bb53404f1a5660c8edaaa2415bac39b53bf7e833c98ed95abb9773cfea57
-
Filesize
542KB
MD51307ac1d277964761eec2d6e9eb4ef61
SHA11304f3902e5373c4bf4971d339b23927f592062f
SHA25630891a3b64c9215195b1289b50e0421a87c5f51c9bf996f4acd74b42da779156
SHA5124fecdce26e5cd317de4e5dc10773684de9ffaae48f1938dfb87651878dbcaf9067faa8c4ac427c17c3dccd4245eb66c7f30a7d5e0a7f9ffa8700d8945a837d2e
-
Filesize
163KB
MD56e2f4258287cb6002e4611062ebc90fe
SHA1c69ce0bb0727dc1d9b13c50b16f053acf26648b3
SHA2566088620b254dc4cc4e613711f4fb3bf5bf8b500e761e41979ba407684bc1c213
SHA512d43ef0c18ec82cabeb56f483b61c23a4ea2d4181d89f710871dee42c1f0ef348fe57fa1cb6786e9ed636fdbced6518c55afbf8acc7878bbe77de1fa233a7d538
-
Filesize
161KB
MD5b6444ea8dd27372a0521325bdef427c3
SHA1bd9fb8417590ad454a9f9a47331392f1d4dbdafb
SHA2560ed06bdb94c2acf3f76a156bbb51c60e1bcaecb65da41f735236ad3b4f6c1816
SHA51209b239560c94edd1741c9be54fa64bfb9d07ffd588545187c53deb40469f934f44ee2b35c40f4bbe53e7c74391107175193e709d2ba87a4d59b19015ce733b49
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB